check known hosts

7 files changed, 122 insertions, 3 deletions

diff --git a/core/src/xmake/engine.c b/core/src/xmake/engine.c
index 78a2f44fa..1a74387d2 100644
--- a/core/src/xmake/engine.c
+++ b/core/src/xmake/engine.c
@@ -142,6 +142,7 @@ tb_int_t xm_io_filelock_close(lua_State* lua);
 // the io/socket functions
 tb_int_t xm_io_socket_open(lua_State* lua);
 tb_int_t xm_io_socket_rawfd(lua_State* lua);
+tb_int_t xm_io_socket_peeraddr(lua_State* lua);
 tb_int_t xm_io_socket_wait(lua_State* lua);
 tb_int_t xm_io_socket_bind(lua_State* lua);
 tb_int_t xm_io_socket_ctrl(lua_State* lua);
@@ -345,6 +346,7 @@ static luaL_Reg const g_io_functions[] =
 ,   { "filelock_close",     xm_io_filelock_close   }
 ,   { "socket_open",        xm_io_socket_open      }
 ,   { "socket_rawfd",       xm_io_socket_rawfd     }
+,   { "socket_peeraddr",    xm_io_socket_peeraddr  }
 ,   { "socket_wait",        xm_io_socket_wait      }
 ,   { "socket_bind",        xm_io_socket_bind      }
 ,   { "socket_ctrl",        xm_io_socket_ctrl      }
diff --git a/core/src/xmake/io/socket_peeraddr.c b/core/src/xmake/io/socket_peeraddr.c
new file mode 100644
index 000000000..bafeb0a7c
--- /dev/null
+++ b/core/src/xmake/io/socket_peeraddr.c
@@ -0,0 +1,67 @@
+/*!A cross-platform build utility based on Lua
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this sock except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (C) 2015-present, TBOOX Open Source Group.
+ *
+ * @author      ruki
+ * @sock        socket_peeraddr.c
+ *
+ */
+
+/* //////////////////////////////////////////////////////////////////////////////////////
+ * trace
+ */
+#define TB_TRACE_MODULE_NAME    "socket_peeraddr"
+#define TB_TRACE_MODULE_DEBUG   (0)
+
+/* //////////////////////////////////////////////////////////////////////////////////////
+ * includes
+ */
+#include "prefix.h"
+
+/* //////////////////////////////////////////////////////////////////////////////////////
+ * macros
+ */
+
+// socket to fd
+#define xm_io_sock2fd(sock)            (lua_Number)tb_sock2fd(sock)
+
+/* //////////////////////////////////////////////////////////////////////////////////////
+ * implementation
+ */
+
+/* io.socket_peeraddr(sock)
+ */
+tb_int_t xm_io_socket_peeraddr(lua_State* lua)
+{
+    // check
+    tb_assert_and_check_return_val(lua, 0);
+
+    // is pointer?
+    if (!xm_lua_ispointer(lua, 1))
+        xm_io_return_error(lua, "get peer address for invalid sock!");
+
+    // get socket
+    tb_socket_ref_t sock = (tb_socket_ref_t)xm_lua_topointer(lua, 1);
+    tb_check_return_val(sock, 0);
+
+    // get peer address
+    tb_ipaddr_t addr;
+    tb_char_t data[256];
+    tb_char_t const* cstr = tb_null;
+    if (tb_socket_peer(sock, &addr) && (cstr = tb_ipaddr_cstr(&addr, data, sizeof(data))))
+        lua_pushstring(lua, cstr);
+    else lua_pushnil(lua);
+    return 1;
+}
diff --git a/core/src/xmake/makefile b/core/src/xmake/makefile
index 34f272fce..d9e8025fb 100644
--- a/core/src/xmake/makefile
+++ b/core/src/xmake/makefile
@@ -85,6 +85,7 @@ xmake_C_FILES 			+= \
 						io/socket_recv \
 						io/socket_recvfrom \
 						io/socket_close \
+						io/socket_peeraddr \
 						io/pipe_open \
 						io/pipe_openpair \
 						io/pipe_close \
diff --git a/xmake/core/base/socket.lua b/xmake/core/base/socket.lua
index 25bff99d0..9a36c45a8 100644
--- a/xmake/core/base/socket.lua
+++ b/xmake/core/base/socket.lua
@@ -97,6 +97,23 @@ function _instance:rawfd()
     return result, errors
 end
 
+-- get socket peer address
+function _instance:peeraddr()
+
+    -- ensure opened
+    local ok, errors = self:_ensure_opened()
+    if not ok then
+        return nil, errors
+    end
+
+    -- get peer address
+    local result, errors = io.socket_peeraddr(self:cdata())
+    if not result and errors then
+        errors = string.format("%s: %s", self, errors)
+    end
+    return result, errors
+end
+
 -- control socket
 function _instance:ctrl(code, value)
 
diff --git a/xmake/core/sandbox/modules/import/core/base/socket.lua b/xmake/core/sandbox/modules/import/core/base/socket.lua
index b86f3b9c5..30633725f 100644
--- a/xmake/core/sandbox/modules/import/core/base/socket.lua
+++ b/xmake/core/sandbox/modules/import/core/base/socket.lua
@@ -82,6 +82,15 @@ function sandbox_core_base_socket_instance.ctrl(sock, code, value)
     return ok
 end
 
+-- get peer address
+function sandbox_core_base_socket_instance.peeraddr(sock)
+    local result, errors = sock:_peeraddr(data, opt)
+    if not result and errors then
+        raise(errors)
+    end
+    return result
+end
+
 -- bind socket
 function sandbox_core_base_socket_instance.bind(sock, addr, port)
     local ok, errors = sock:_bind(addr, port)
diff --git a/xmake/modules/private/service/remote_build/server.lua b/xmake/modules/private/service/remote_build/server.lua
index fe720310b..3b29c5fee 100644
--- a/xmake/modules/private/service/remote_build/server.lua
+++ b/xmake/modules/private/service/remote_build/server.lua
@@ -66,7 +66,7 @@ function remote_build_server:_on_handle(stream, msg)
     {
         function()
             if self:need_verfiy() then
-                local ok, errors = self:verify_user(msg:auth())
+                local ok, errors = self:verify_user(msg:auth(), stream:sock():peeraddr())
                 if not ok then
                     session_errs = errors
                     return false
diff --git a/xmake/modules/private/service/server.lua b/xmake/modules/private/service/server.lua
index 0da31c995..d3cb0055a 100644
--- a/xmake/modules/private/service/server.lua
+++ b/xmake/modules/private/service/server.lua
@@ -39,6 +39,10 @@ function server:init(daemon)
     -- init authorizations
     local auths = config.get("server.auths")
     self:auths_set(auths)
+
+    -- init known hosts
+    local known_hosts = config.get("server.known_hosts")
+    self:known_hosts_set(known_hosts)
 end
 
 -- is daemon?
@@ -84,13 +88,23 @@ function server:auths_set(auths)
     self._AUTHS = auths and hashset.from(auths) or hashset.new()
 end
 
+-- get known hosts
+function server:known_hosts()
+    return self._KNOWN_HOSTS
+end
+
+-- set known hosts
+function server:known_hosts_set(hosts)
+    self._KNOWN_HOSTS = hosts and hashset.from(hosts) or hashset.new()
+end
+
 -- we need verify user
 function server:need_verfiy()
     return not self:auths():empty()
 end
 
 -- verify user
-function server:verify_user(auth)
+function server:verify_user(auth, peeraddr)
     if not auth then
         return false, "client has no authorization, we need add user name to `remote_build.client.connect`!"
     end
@@ -100,7 +114,16 @@ function server:verify_user(auth)
         return false, "user and password are incorrect!"
     end
 
-    -- TODO check known_hosts
+    -- check known_hosts
+    if not self:known_hosts():empty() and peeraddr then
+        local addrinfo = peeraddr:split(":")
+        if addrinfo and #addrinfo == 2 then
+            local addr = addrinfo[1]
+            if not self:known_hosts():has(addr) then
+                return false, "your host address is unknown in server!"
+            end
+        end
+    end
     return true
 end