338 lines
15 KiB
Swift
338 lines
15 KiB
Swift
import CryptoKit
|
|
import Foundation
|
|
import TermindApplication
|
|
import TermindDomain
|
|
|
|
/// One import session owns only source descriptors and public metadata. Private
|
|
/// key text is read inside scan, unlock, or commit and never becomes actor state.
|
|
public actor SSHImportReader: SSHImportReading {
|
|
private let username: String
|
|
private let home: URL?
|
|
|
|
public init(username: String, home: URL? = nil) {
|
|
self.username = username
|
|
self.home = home
|
|
}
|
|
|
|
private struct KeySource {
|
|
let url: URL
|
|
let digest: Data
|
|
}
|
|
|
|
private struct KeyCandidate {
|
|
let url: URL
|
|
let path: String
|
|
let digest: Data
|
|
let encrypted: Bool
|
|
}
|
|
|
|
private struct CertificateSource {
|
|
let path: String
|
|
let text: String
|
|
}
|
|
|
|
private struct FilePayload {
|
|
let text: String
|
|
let digest: Data
|
|
}
|
|
|
|
private var keySources: [UUID: KeySource] = [:]
|
|
private var certificateSources: [CertificateSource] = []
|
|
private var accessScopes: [URL] = []
|
|
private var stableIDs: [String: UUID] = [:]
|
|
|
|
public func discard() {
|
|
keySources.removeAll()
|
|
certificateSources.removeAll()
|
|
accessScopes.removeAll()
|
|
}
|
|
|
|
public func scan(root: URL, knownHostsOnly: Bool, grants: [URL] = []) throws -> [SSHImportItem] {
|
|
discard()
|
|
let scopes = [root] + grants
|
|
accessScopes = scopes
|
|
let acquired = scopes.filter { $0.startAccessingSecurityScopedResource() }
|
|
defer { for url in acquired { url.stopAccessingSecurityScopedResource() } }
|
|
|
|
let sourceType = try root.resourceValues(forKeys: [.isDirectoryKey, .isRegularFileKey])
|
|
guard knownHostsOnly ? sourceType.isRegularFile == true : sourceType.isDirectory == true else {
|
|
throw knownHostsOnly ? SSHImportSourceError.expectedFile : SSHImportSourceError.expectedFolder
|
|
}
|
|
if knownHostsOnly {
|
|
let payload = try readPayload(root)
|
|
let kind = SSHImportParser.contentKind(payload.text)
|
|
guard kind == .knownHosts || containsOnlyCommentsAndWhitespace(payload.text) else {
|
|
throw SSHImportSourceError.unsupportedKnownHostsContent
|
|
}
|
|
return stabilize(SSHImportParser.knownHosts(payload.text, source: root.path))
|
|
}
|
|
|
|
let standardizedRoot = root.standardizedFileURL
|
|
let authorized = scopes.map { $0.resolvingSymlinksInPath().standardizedFileURL.path }
|
|
func allowed(_ url: URL) -> Bool {
|
|
let path = url.resolvingSymlinksInPath().standardizedFileURL.path
|
|
return authorized.contains { path == $0 || path.hasPrefix($0 + "/") }
|
|
}
|
|
|
|
var configurationFiles: [String: String] = [:]
|
|
var knownHostItems: [SSHImportItem] = []
|
|
var keyCandidates: [String: KeyCandidate] = [:]
|
|
var contentKinds: [String: SSHImportContentKind] = [:]
|
|
var availablePaths: Set<String> = []
|
|
var inaccessible: [String] = []
|
|
var fileCount = 0
|
|
var totalBytes = 0
|
|
let manager = FileManager.default
|
|
|
|
for scope in scopes {
|
|
var directory: ObjCBool = false
|
|
guard manager.fileExists(atPath: scope.path, isDirectory: &directory) else { continue }
|
|
let urls: [URL]
|
|
if directory.boolValue {
|
|
let enumerator = manager.enumerator(
|
|
at: scope,
|
|
includingPropertiesForKeys: [.fileSizeKey, .isRegularFileKey, .isSymbolicLinkKey],
|
|
options: [])
|
|
urls = enumerator?.allObjects.compactMap { $0 as? URL } ?? []
|
|
} else {
|
|
urls = [scope]
|
|
}
|
|
for url in urls {
|
|
let values = try? url.resourceValues(forKeys: [.fileSizeKey, .isRegularFileKey, .isSymbolicLinkKey])
|
|
guard values?.isRegularFile == true || values?.isSymbolicLink == true else { continue }
|
|
guard allowed(url) else {
|
|
inaccessible.append(url.path)
|
|
continue
|
|
}
|
|
fileCount += 1
|
|
guard fileCount <= 4_096 else { throw CocoaError(.fileReadTooLarge) }
|
|
let fileSize = values?.fileSize ?? 0
|
|
totalBytes += fileSize
|
|
guard fileSize <= 8 * 1_024 * 1_024, totalBytes <= 64 * 1_024 * 1_024 else {
|
|
throw CocoaError(.fileReadTooLarge)
|
|
}
|
|
let path = url.standardizedFileURL.path
|
|
do {
|
|
let payload = try readPayload(url)
|
|
let kind = SSHImportParser.contentKind(payload.text)
|
|
availablePaths.insert(path)
|
|
contentKinds[path] = kind
|
|
switch kind {
|
|
case .privateKey:
|
|
keyCandidates[path] = KeyCandidate(
|
|
url: url, path: path, digest: payload.digest,
|
|
encrypted: isEncrypted(payload.text))
|
|
case .userCertificate:
|
|
certificateSources.append(
|
|
CertificateSource(
|
|
path: path,
|
|
text: payload.text.trimmingCharacters(in: .whitespacesAndNewlines)))
|
|
case .knownHosts:
|
|
knownHostItems += SSHImportParser.knownHosts(payload.text, source: path)
|
|
case .configuration:
|
|
configurationFiles[path] = payload.text
|
|
case .unknown:
|
|
break
|
|
}
|
|
} catch {
|
|
inaccessible.append(path)
|
|
}
|
|
}
|
|
}
|
|
|
|
var parser = SSHConfigParser(
|
|
root: standardizedRoot, home: home ?? standardizedRoot.deletingLastPathComponent(),
|
|
username: username, files: configurationFiles,
|
|
entryPaths: configurationFiles.keys.sorted())
|
|
var items = parser.parse() + knownHostItems
|
|
let hosts = items.compactMap(\.host)
|
|
let referencedKeys = Set(hosts.flatMap(\.identityPaths))
|
|
|
|
for path in Set(keyCandidates.keys).union(referencedKeys).sorted() {
|
|
guard let candidate = keyCandidates[path] else {
|
|
if availablePaths.contains(path), contentKinds[path] != .privateKey {
|
|
items.append(
|
|
SSHImportItem(
|
|
category: .keys, name: URL(fileURLWithPath: path).lastPathComponent,
|
|
source: path, selected: false,
|
|
issue: String(localized: "No supported private key in this file."), unavailable: true))
|
|
}
|
|
continue
|
|
}
|
|
if candidate.encrypted {
|
|
let id = stableID(path + "\n")
|
|
keySources[id] = KeySource(url: candidate.url, digest: candidate.digest)
|
|
items.append(
|
|
SSHImportItem(
|
|
id: id, category: .keys, name: URL(fileURLWithPath: path).lastPathComponent,
|
|
source: path,
|
|
issue: String(localized: "Enter the key passphrase to validate this private key."),
|
|
requiresPassphrase: true))
|
|
continue
|
|
}
|
|
do {
|
|
let material = try inspect(candidate, passphrase: nil)
|
|
items += makeKeyItems(candidate: candidate, material: material)
|
|
} catch {
|
|
items.append(
|
|
SSHImportItem(
|
|
category: .keys, name: URL(fileURLWithPath: path).lastPathComponent,
|
|
source: path, selected: false,
|
|
issue: String(localized: "No supported private key in this file."), unavailable: true))
|
|
}
|
|
}
|
|
|
|
let missingKeys = hosts.filter { !$0.usesDefaultIdentityFiles }.flatMap(\.identityPaths).filter {
|
|
!availablePaths.contains($0)
|
|
}
|
|
let missingCertificates = hosts.flatMap(\.certificatePaths).filter { !availablePaths.contains($0) }
|
|
for path in Set(inaccessible).union(parser.externalPaths).union(missingKeys).union(missingCertificates).sorted()
|
|
{
|
|
items.append(
|
|
SSHImportItem(
|
|
category: parser.externalPaths.contains(path) ? .hosts : .keys,
|
|
name: URL(fileURLWithPath: path).lastPathComponent, source: path,
|
|
issue: String(localized: "Authorize access to this referenced file, or deselect it."),
|
|
needsAuthorization: path))
|
|
}
|
|
|
|
// Missing explicit references must also be visible on the affected host.
|
|
for index in items.indices {
|
|
guard let host = items[index].host else { continue }
|
|
let absent = (host.identityPaths + host.certificatePaths).filter {
|
|
!availablePaths.contains($0) && !(host.usesDefaultIdentityFiles && host.identityPaths.contains($0))
|
|
}
|
|
items[index].warnings += absent.map { String(localized: "Referenced file is unavailable:") + " " + $0 }
|
|
}
|
|
return stabilize(items)
|
|
}
|
|
|
|
public func unlock(id: UUID, name: String, passphrase: String) throws -> [SSHImportItem] {
|
|
guard let source = keySources[id] else { throw CocoaError(.fileReadUnknown) }
|
|
return try withAccess {
|
|
let payload = try readPayload(source.url)
|
|
guard payload.digest == source.digest, SSHImportParser.contentKind(payload.text) == .privateKey else {
|
|
throw SSHImportSourceError.sourceChanged
|
|
}
|
|
let material = try SSHKeyMaterial.inspect(privateKey: payload.text, passphrase: passphrase)
|
|
let candidate = KeyCandidate(
|
|
url: source.url, path: source.url.standardizedFileURL.path,
|
|
digest: source.digest, encrypted: true)
|
|
keySources.removeValue(forKey: id)
|
|
return makeKeyItems(candidate: candidate, material: material, name: name, hasPassphrase: true)
|
|
}
|
|
}
|
|
|
|
public func credentials(for ids: Set<UUID>) throws -> [UUID: StoredSSHKeyCredential] {
|
|
try withAccess {
|
|
var result: [UUID: StoredSSHKeyCredential] = [:]
|
|
for id in ids.sorted(by: { $0.uuidString < $1.uuidString }) {
|
|
guard let source = keySources[id] else { throw CocoaError(.fileReadUnknown) }
|
|
let payload = try readPayload(source.url)
|
|
guard payload.digest == source.digest, SSHImportParser.contentKind(payload.text) == .privateKey else {
|
|
throw SSHImportSourceError.sourceChanged
|
|
}
|
|
result[id] = .software(SSHPrivateKeySecret(privateKey: payload.text))
|
|
}
|
|
return result
|
|
}
|
|
}
|
|
|
|
private func inspect(_ candidate: KeyCandidate, passphrase: String?) throws -> SSHKeyMaterial {
|
|
try withAccess {
|
|
let payload = try readPayload(candidate.url)
|
|
guard payload.digest == candidate.digest else { throw SSHImportSourceError.sourceChanged }
|
|
return try SSHKeyMaterial.inspect(privateKey: payload.text, passphrase: passphrase)
|
|
}
|
|
}
|
|
|
|
private func makeKeyItems(
|
|
candidate: KeyCandidate, material: SSHKeyMaterial, name: String? = nil, hasPassphrase: Bool = false
|
|
) -> [SSHImportItem] {
|
|
var variants: [String: [String]] = [:]
|
|
for certificate in certificateSources {
|
|
if (try? SSHUserCertificate.parse(certificate.text, matching: material.publicKey)) != nil {
|
|
variants[certificate.text, default: []].append(certificate.path)
|
|
}
|
|
}
|
|
// The private key remains a valid variant in its own right. Hosts with
|
|
// an explicit CertificateFile select the matching certificate path;
|
|
// hosts without one continue to use the bare key.
|
|
variants[""] = []
|
|
return variants.keys.sorted().map { certificate in
|
|
let id = stableID(candidate.path + "\n" + certificate)
|
|
keySources[id] = KeySource(url: candidate.url, digest: candidate.digest)
|
|
let label = name ?? URL(fileURLWithPath: candidate.path).lastPathComponent
|
|
let key = SSHKeyRef(
|
|
id: id, label: label, algorithm: material.algorithm,
|
|
publicKey: material.publicKey, certificate: certificate, fingerprint: material.fingerprint,
|
|
credentialRef: "termind.key.\(id.uuidString)", storage: .iCloud, keySize: material.keySize,
|
|
hasPassphrase: hasPassphrase, createdAt: Date())
|
|
return SSHImportItem(
|
|
id: id, category: .keys, name: label, source: candidate.path,
|
|
key: key, certificatePaths: variants[certificate] ?? [])
|
|
}
|
|
}
|
|
|
|
private func stableID(_ source: String) -> UUID {
|
|
if let id = stableIDs[source] { return id }
|
|
let id = UUID()
|
|
stableIDs[source] = id
|
|
return id
|
|
}
|
|
|
|
private func stabilize(_ values: [SSHImportItem]) -> [SSHImportItem] {
|
|
var occurrences: [String: Int] = [:]
|
|
return values.map { item in
|
|
var item = item
|
|
if keySources[item.id] == nil {
|
|
let token = "\(item.category.rawValue):\(item.source):\(item.name)"
|
|
let occurrence = occurrences[token, default: 0]
|
|
occurrences[token] = occurrence + 1
|
|
item.id = stableID(token + ":\(occurrence)")
|
|
}
|
|
return item
|
|
}
|
|
}
|
|
|
|
private func withAccess<T>(_ operation: () throws -> T) rethrows -> T {
|
|
let acquired = accessScopes.filter { $0.startAccessingSecurityScopedResource() }
|
|
defer { for url in acquired { url.stopAccessingSecurityScopedResource() } }
|
|
return try operation()
|
|
}
|
|
|
|
private func readPayload(_ url: URL) throws -> FilePayload {
|
|
let values = try url.resourceValues(forKeys: [.fileSizeKey, .isRegularFileKey])
|
|
guard values.isRegularFile == true, (values.fileSize ?? 0) <= 8 * 1_024 * 1_024 else {
|
|
throw CocoaError(.fileReadTooLarge)
|
|
}
|
|
let data = try Data(contentsOf: url, options: [.mappedIfSafe])
|
|
guard let text = String(data: data, encoding: .utf8) else {
|
|
throw CocoaError(.fileReadInapplicableStringEncoding)
|
|
}
|
|
return FilePayload(text: text, digest: Data(SHA256.hash(data: data)))
|
|
}
|
|
|
|
private func containsOnlyCommentsAndWhitespace(_ text: String) -> Bool {
|
|
text.components(separatedBy: .newlines).allSatisfy {
|
|
let line = $0.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
return line.isEmpty || line.hasPrefix("#")
|
|
}
|
|
}
|
|
|
|
private func isEncrypted(_ text: String) -> Bool {
|
|
if text.contains("-----BEGIN ENCRYPTED PRIVATE KEY-----") || text.contains("DEK-Info:") { return true }
|
|
guard text.hasPrefix("-----BEGIN OPENSSH PRIVATE KEY-----") else { return false }
|
|
let encoded = text.components(separatedBy: .newlines).filter { !$0.hasPrefix("-----") }.joined()
|
|
let magic = Data("openssh-key-v1\0".utf8)
|
|
guard let data = Data(base64Encoded: encoded), data.starts(with: magic), data.count >= magic.count + 4 else {
|
|
return false
|
|
}
|
|
let offset = magic.count
|
|
let length = data[offset..<offset + 4].reduce(UInt32(0)) { ($0 << 8) | UInt32($1) }
|
|
guard Int(length) <= data.count - offset - 4 else { return false }
|
|
let cipher = String(data: data.subdata(in: offset + 4..<offset + 4 + Int(length)), encoding: .utf8)
|
|
return cipher != nil && cipher != "none"
|
|
}
|
|
}
|