impl hostkey verify for working dir

plugin/internal/workingdir/workingdir.go

@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"fmt"
 	"io/ioutil"
+	"net"
 	"os"
 	"path"
 	"regexp"
@@ -12,6 +13,7 @@ import (
 
 	"github.com/tg123/sshpiper/libplugin"
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/knownhosts"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -90,6 +92,29 @@ func (w *Workingdir) CreateUpstream() (*libplugin.Upstream, error) {
 	}, nil
 }
 
+func (w *Workingdir) VerifyHostKey(hostname, netaddr string, key []byte) error {
+	if !w.Strict {
+		return nil
+	}
+
+	hostKeyCallback, err := knownhosts.New(w.fullpath(userKnownHosts))
+	if err != nil {
+		return err
+	}
+
+	pub, err := ssh.ParsePublicKey(key)
+	if err != nil {
+		return err
+	}
+
+	addr, err := net.ResolveTCPAddr("tcp", netaddr)
+	if err != nil {
+		return err
+	}
+
+	return hostKeyCallback(hostname, addr, pub)
+}
+
 func (w *Workingdir) checkPerm(file string) error {
 	filename := path.Join(w.Path, file)
 	f, err := os.Open(filename)

plugin/workingdir/main.go

@@ -98,8 +98,13 @@ func main() {
 					return u, nil
 				},
 
-				VerifyHostKeyCallback: func(conn libplugin.ConnMetadata, key []byte) (bool, error) {
-					return true, nil
+				VerifyHostKeyCallback: func(conn libplugin.ConnMetadata, hostname, netaddr string, key []byte) error {
+					w, err := createWorkingdir(c, conn.User())
+					if err != nil {
+						return err
+					}
+
+					return w.VerifyHostKey(hostname, netaddr, key)
 				},
 			}, nil
 		},

plugin/workingdirbykey/main.go

@@ -68,7 +68,7 @@ func main() {
 						w := &workingdir.Workingdir{
 							Path:        path,
 							NoCheckPerm: c.Bool("no-check-perm"),
-							Strict:      c.Bool("strict-hostkey"),
+							Strict:      false,
 						}
 
 						u, err := w.CreateUpstream()
@@ -92,10 +92,6 @@ func main() {
 
 					return nil, fmt.Errorf("no matching public key found in %v", userdir)
 				},
-
-				VerifyHostKeyCallback: func(conn libplugin.ConnMetadata, key []byte) (bool, error) {
-					return true, nil
-				},
 			}, nil
 		},
 	})