check known hosts

4 files changed, 52 insertions, 3 deletions

diff --git a/xmake/core/base/socket.lua b/xmake/core/base/socket.lua
index 25bff99d0..9a36c45a8 100644
--- a/xmake/core/base/socket.lua
+++ b/xmake/core/base/socket.lua
@@ -97,6 +97,23 @@ function _instance:rawfd()
     return result, errors
 end
 
+-- get socket peer address
+function _instance:peeraddr()
+
+    -- ensure opened
+    local ok, errors = self:_ensure_opened()
+    if not ok then
+        return nil, errors
+    end
+
+    -- get peer address
+    local result, errors = io.socket_peeraddr(self:cdata())
+    if not result and errors then
+        errors = string.format("%s: %s", self, errors)
+    end
+    return result, errors
+end
+
 -- control socket
 function _instance:ctrl(code, value)
 
diff --git a/xmake/core/sandbox/modules/import/core/base/socket.lua b/xmake/core/sandbox/modules/import/core/base/socket.lua
index b86f3b9c5..30633725f 100644
--- a/xmake/core/sandbox/modules/import/core/base/socket.lua
+++ b/xmake/core/sandbox/modules/import/core/base/socket.lua
@@ -82,6 +82,15 @@ function sandbox_core_base_socket_instance.ctrl(sock, code, value)
     return ok
 end
 
+-- get peer address
+function sandbox_core_base_socket_instance.peeraddr(sock)
+    local result, errors = sock:_peeraddr(data, opt)
+    if not result and errors then
+        raise(errors)
+    end
+    return result
+end
+
 -- bind socket
 function sandbox_core_base_socket_instance.bind(sock, addr, port)
     local ok, errors = sock:_bind(addr, port)
diff --git a/xmake/modules/private/service/remote_build/server.lua b/xmake/modules/private/service/remote_build/server.lua
index fe720310b..3b29c5fee 100644
--- a/xmake/modules/private/service/remote_build/server.lua
+++ b/xmake/modules/private/service/remote_build/server.lua
@@ -66,7 +66,7 @@ function remote_build_server:_on_handle(stream, msg)
     {
         function()
             if self:need_verfiy() then
-                local ok, errors = self:verify_user(msg:auth())
+                local ok, errors = self:verify_user(msg:auth(), stream:sock():peeraddr())
                 if not ok then
                     session_errs = errors
                     return false
diff --git a/xmake/modules/private/service/server.lua b/xmake/modules/private/service/server.lua
index 0da31c995..d3cb0055a 100644
--- a/xmake/modules/private/service/server.lua
+++ b/xmake/modules/private/service/server.lua
@@ -39,6 +39,10 @@ function server:init(daemon)
     -- init authorizations
     local auths = config.get("server.auths")
     self:auths_set(auths)
+
+    -- init known hosts
+    local known_hosts = config.get("server.known_hosts")
+    self:known_hosts_set(known_hosts)
 end
 
 -- is daemon?
@@ -84,13 +88,23 @@ function server:auths_set(auths)
     self._AUTHS = auths and hashset.from(auths) or hashset.new()
 end
 
+-- get known hosts
+function server:known_hosts()
+    return self._KNOWN_HOSTS
+end
+
+-- set known hosts
+function server:known_hosts_set(hosts)
+    self._KNOWN_HOSTS = hosts and hashset.from(hosts) or hashset.new()
+end
+
 -- we need verify user
 function server:need_verfiy()
     return not self:auths():empty()
 end
 
 -- verify user
-function server:verify_user(auth)
+function server:verify_user(auth, peeraddr)
     if not auth then
         return false, "client has no authorization, we need add user name to `remote_build.client.connect`!"
     end
@@ -100,7 +114,16 @@ function server:verify_user(auth)
         return false, "user and password are incorrect!"
     end
 
-    -- TODO check known_hosts
+    -- check known_hosts
+    if not self:known_hosts():empty() and peeraddr then
+        local addrinfo = peeraddr:split(":")
+        if addrinfo and #addrinfo == 2 then
+            local addr = addrinfo[1]
+            if not self:known_hosts():has(addr) then
+                return false, "your host address is unknown in server!"
+            end
+        end
+    end
     return true
 end