vrubelroman/vcom
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: verify SSH host keys, support ssh-agent, fix remote dir walk bugs

Browse source 
- Replace ssh.InsecureIgnoreHostKey() with TOFU verification against
  ~/.ssh/known_hosts (accept-new for unknown hosts, hard reject on a
  changed key) to close a MITM hole on every SFTP connection.
- Actually connect to a running ssh-agent (SSH_AUTH_SOCK) for auth
  instead of only scanning default key files on disk; give a clear
  error when an explicit IdentityFile is passphrase-protected.
- Fix SSHClient.walk()/DirectorySize: the internal filepathSkipDir
  sentinel leaked out as a real error on stat/ReadDir failures instead
  of being swallowed, aborting size calculation on the first
  unreadable subdirectory instead of skipping it.
- Skip symlink-to-directory entries in remote directory copies instead
  of failing the whole transfer trying to Open() them as regular files.
- Consolidate 5 duplicated sudo-aware home-dir lookups into
  internal/homedir, adding a missing os.Geteuid()==0 check before
  trusting SUDO_USER.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
vrubelroman 2026-07-03 15:31:32 +00:00
parent 3cf9582147
commit c15ade247a
16 changed files with 2580 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

30
internal/fs/remote/config.go
View file

@ -6,13 +6,15 @@ import (
"os"
"path/filepath"
"strings"
"vcom/internal/homedir"
)
// ParseSSHConfig parses ~/.ssh/config and returns a list of SSH hosts.
// It handles the most common SSH config directives: Host, HostName, Port, User, IdentityFile.
func ParseSSHConfig() []SSHHost {
home, err := os.UserHomeDir()
if err != nil {
home := homedir.Dir()
if home == "" {
return nil
}
@ -129,8 +131,8 @@ func resolveIdentityPath(path string) string {
// Handle ~/ or $HOME/
if strings.HasPrefix(path, "~/") {
home, err := os.UserHomeDir()
if err != nil {
home := homedir.Dir()
if home == "" {
return path
}
path = filepath.Join(home, path[2:])
@ -138,8 +140,8 @@ func resolveIdentityPath(path string) string {
// Handle relative paths (relative to ~/.ssh/)
if !filepath.IsAbs(path) {
home, err := os.UserHomeDir()
if err != nil {
home := homedir.Dir()
if home == "" {
return path
}
path = filepath.Join(home, ".ssh", path)
@ -150,8 +152,8 @@ func resolveIdentityPath(path string) string {
// SSHConfigPath returns the path to the user's SSH config file.
func SSHConfigPath() string {
home, err := os.UserHomeDir()
if err != nil {
home := homedir.Dir()
if home == "" {
return ""
}
return filepath.Join(home, ".ssh", "config")
@ -159,8 +161,8 @@ func SSHConfigPath() string {
// HostsFilePath returns the path to the custom hosts data file.
func HostsFilePath() string {
home, err := os.UserHomeDir()
if err != nil {
home := homedir.Dir()
if home == "" {
return ""
}
return filepath.Join(home, ".config", "vcom", "hosts.dat")
@ -168,8 +170,8 @@ func HostsFilePath() string {
// GetSSHDir returns the path to the .ssh directory.
func GetSSHDir() string {
home, err := os.UserHomeDir()
if err != nil {
home := homedir.Dir()
if home == "" {
return ""
}
return filepath.Join(home, ".ssh")
@ -177,8 +179,8 @@ func GetSSHDir() string {
// KnownHostsPath returns the path to known_hosts.
func KnownHostsPath() string {
home, err := os.UserHomeDir()
if err != nil {
home := homedir.Dir()
if home == "" {
return ""
}
return filepath.Join(home, ".ssh", "known_hosts")