petrbalvin/goget
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat: extend certificate pinning to all TLS protocols and add SSH

Browse Source 
host-key pinning
This commit is contained in:
petrbalvin
2026-06-29 19:23:10 +02:00
parent e7ed3a334e
commit fc65ea8340
19 changed files with 355 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/protocol/sftp/sftp.go
+5 -5
View File
@@ -113,7 +113,7 @@ type client struct {
maxPacket uint32
}
func dial(ctx context.Context, u *url.URL, knownHostsPath string, insecure bool) (*client, error) {
func dial(ctx context.Context, u *url.URL, knownHostsPath string, insecure bool, pinnedHostKey string) (*client, error) {
host := u.Hostname()
port := u.Port()
if port == "" {
@@ -127,7 +127,7 @@ func dial(ctx context.Context, u *url.URL, knownHostsPath string, insecure bool)
addr := net.JoinHostPort(host, port)
hostKeyCB, err := hostKeyCallback(knownHostsPath, insecure)
hostKeyCB, err := hostKeyCallback(knownHostsPath, insecure, pinnedHostKey)
if err != nil {
return nil, err
}
@@ -639,7 +639,7 @@ func download(ctx context.Context, req *core.DownloadRequest) (*core.DownloadRes
return downloadRecursiveSequential(ctx, req)
}
c, err := dial(ctx, req.URL, req.SSHKnownHosts, req.SSHInsecure)
c, err := dial(ctx, req.URL, req.SSHKnownHosts, req.SSHInsecure, req.PinnedHostKey)
if err != nil {
return nil, err
}
@@ -816,7 +816,7 @@ func newSFTPClientPool(ctx context.Context, req *core.DownloadRequest, size int)
all := make([]*client, 0, size)
avail := make(chan *client, size)
for i := 0; i < size; i++ {
c, err := dial(ctx, req.URL, req.SSHKnownHosts, req.SSHInsecure)
c, err := dial(ctx, req.URL, req.SSHKnownHosts, req.SSHInsecure, req.PinnedHostKey)
if err != nil {
for _, existing := range all {
existing.close()
@@ -854,7 +854,7 @@ func (p *sftpClientPool) close() {
// downloadRecursiveParallel and is enabled when req.RecursiveParallel
// is greater than one.
func downloadRecursiveSequential(ctx context.Context, req *core.DownloadRequest) (*core.DownloadResult, error) {
c, err := dial(ctx, req.URL, req.SSHKnownHosts, req.SSHInsecure)
c, err := dial(ctx, req.URL, req.SSHKnownHosts, req.SSHInsecure, req.PinnedHostKey)
if err != nil {
return nil, err
}