Module cargo::sources::git::known_hosts
source · Expand description
SSH host key validation support.
The only public item in this module is certificate_check,
which provides a callback to git2::RemoteCallbacks::certificate_check.
A primary goal with this implementation is to provide user-friendly error messages, guiding them to understand the issue and how to resolve it.
Note that there are a lot of limitations here. This reads OpenSSH known_hosts files from well-known locations, but it does not read OpenSSH config files. The config file can change the behavior of how OpenSSH handles known_hosts files. For example, some things we don’t handle:
GlobalKnownHostsFile— Changes the location of the global host file.UserKnownHostsFile— Changes the location of the user’s host file.KnownHostsCommand— A command to fetch known hosts.CheckHostIP— DNS spoofing checks.VisualHostKey— Shows a visual ascii-art key.VerifyHostKeyDNS— Uses SSHFP DNS records to fetch a host key.
There’s also a number of things that aren’t supported but could be easily added (it just adds a little complexity). For example, hostname patterns, and revoked markers. See “FIXME” comments littered in this file.
Structs§
- A single known host entry.
Enums§
- The location where a host key was located.
Constants§
Statics§
- These are host keys that are hard-coded in cargo to provide convenience.
- List of keys that public hosts have rotated away from.
Functions§
- The git2 callback used to validate a certificate (only ssh known hosts are validated).
- Checks if the given host/host key pair is known.
- Checks a host key against a loaded set of known hosts.
- Returns a list of files to try loading OpenSSH-formatted known hosts.
- Loads an OpenSSH known_hosts file.
- The location of the user’s known_hosts file.
- The location to display in an error message instructing the user where to add the new key.