Module known_hosts

SSH host key validation support.

The only public item in this module is certificate_check, which provides a callback to git2::RemoteCallbacks::certificate_check.

A primary goal with this implementation is to provide user-friendly error messages, guiding them to understand the issue and how to resolve it.

Note that there are a lot of limitations here. This reads OpenSSH known_hosts files from well-known locations, but it does not read OpenSSH config files. The config file can change the behavior of how OpenSSH handles known_hosts files. For example, some things we don’t handle:

• GlobalKnownHostsFile — Changes the location of the global host file.
• UserKnownHostsFile — Changes the location of the user’s host file.
• KnownHostsCommand — A command to fetch known hosts.
• CheckHostIP — DNS spoofing checks.
• VisualHostKey — Shows a visual ascii-art key.
• VerifyHostKeyDNS — Uses SSHFP DNS records to fetch a host key.

There’s also a number of things that aren’t supported but could be easily added (it just adds a little complexity). For example, hostname patterns, and revoked markers. See “FIXME” comments littered in this file.

Structs

• KnownHost 🔒
  A single known host entry.

Enums

• KnownHostError 🔒
• KnownHostLineType 🔒
• KnownHostLocation 🔒
  The location where a host key was located.

Constants

• HASH_HOSTNAME_PREFIX 🔒

Statics

• BUNDLED_KEYS 🔒
  These are host keys that are hard-coded in cargo to provide convenience.
• BUNDLED_REVOCATIONS 🔒
  List of keys that public hosts have rotated away from.

Functions

• certificate_check
  The git2 callback used to validate a certificate (only ssh known hosts are validated).
• check_ssh_known_hosts 🔒
  Checks if the given host/host key pair is known.
• check_ssh_known_hosts_loaded 🔒
  Checks a host key against a loaded set of known hosts.
• hashed_hostname_matches 🔒
• known_host_files 🔒
  Returns a list of files to try loading OpenSSH-formatted known hosts.
• load_hostfile 🔒
  Loads an OpenSSH known_hosts file.
• load_hostfile_contents 🔒
• parse_known_hosts_line 🔒
• user_known_host_location 🔒
  The location of the user’s known_hosts file.
• user_known_host_location_to_add 🔒
  The location to display in an error message instructing the user where to add the new key.