Commit `ead6796abe`

ead6796abebaaed89488c7ab91788799c54b71ed

parent: bd49b87fce

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-28 22:55 UTC

hookd: audit refused hook requests and refused pushes

Ref #275

Layout: unified · split

.gitbay/wiki/Admin.org +6 −2

 The audit log is the security feed (events are the product feed): every
 successful mutating command with its argv and source credential (SSH key
 fingerprint or API), every refused one (exit 3 or 4) as =refused
-<command>=, refused pushes as =refused git-receive-pack=, registrations,
+<command>=, refused pushes as =refused git-receive-pack= (the access
-admin actions, force-pushes, and auth failures/throttling. A refusal row
+check) or =refused push= (a branch or tag rule, a release anchor or an
+unsigned commit, with the repository and ref names), hook socket
+requests failing the peer or push-token check as =refused hook= (never
+the token), registrations, admin actions, force-pushes, and auth
+failures/throttling. A refusal row
 keeps the flag names and the first positional, not the values.
 Refusals are recorded up to ten a minute per account and 600 a minute
 across the instance; past either, one =refused.throttled= row stands

CHANGELOG.org +4

   =refused.throttled= row stands for the rest of the minute. Under
   =ssh.mode = "system"= each =gitbayd shell= connection counts
   separately (#275).
+- Pushes refused in pre-receive (a branch or tag rule, a release
+  anchor, an unsigned commit) are audited as =refused push= with the
+  repository and ref names, and hook socket requests failing the peer
+  or push-token check as =refused hook=, under the same caps (#275).
 - Audit retention deletes by id, up to the newest row older than the
   retention, so a clock step back cannot leave a gap in the chain (#275).
 - =dashboard= and =feed= print activity as sentences

internal/hookd/hookd.go +30 −10

 	defer conn.Close()
 	dec := json.NewDecoder(conn)
 	enc := json.NewEncoder(conn)
-	if err := checkPeer(conn); err != nil {
+	if err := peerCheck(conn); err != nil {
 		slog.Warn("hook socket: refused connection", "err", err)
+		// Nothing about the request is known yet, and no account.
+		control.AuditRefused(s.st, 0, "refused hook", map[string]any{"reason": err.Error()})
 		enc.Encode(Response{Allow: false, Message: "hook socket: " + err.Error()})
 		return
 	}
 		enc.Encode(Response{Allow: false, Message: "bad hook request"})
 		return
 	}
-	if msg := s.authorize(req); msg != "" {
+	if actor, msg := s.authorize(req); msg != "" {
+		control.AuditRefused(s.st, actor, "refused hook",
+			map[string]any{"repo_id": req.RepoID, "hook": req.Hook, "reason": msg})
 		enc.Encode(Response{Allow: false, Message: msg})
 		return
 	}
 // authorize ties a request to a receive-pack sshd started: its token
 // must be live and name the same repository, account and key scope.
-func (s *Server) authorize(req Request) string {
+// On a refusal actor is the token's account when the token is live,
+// and 0 otherwise: the request's own user id is only a claim.
+func (s *Server) authorize(req Request) (actor int64, msg string) {
 	if req.Token == "" {
-		return "push not started by this server"
+		return 0, "push not started by this server"
 	}
 	tok, err := s.st.PushTokenByHash(store.HashToken(req.Token))
 	if err != nil {
-		return "push not started by this server"
+		return 0, "push not started by this server"
 	}
 	if tok.RepoID != req.RepoID || tok.UserID != req.UserID || tok.Scope != req.Scope {
-		return "push token does not match this request"
+		return tok.UserID, "push token does not match this request"
 	}
-	return ""
+	return 0, ""
+}
+// peerCheck is checkPeer; tests replace it.
+var peerCheck = checkPeer
+// refusePush answers a pre-receive refusal and audits it.
+func (s *Server) refusePush(enc *json.Encoder, req Request, repo store.Repo, msg string) {
+	refs := make([]string, len(req.Updates))
+	for i, u := range req.Updates {
+		refs[i] = u.Ref
+	}
+	control.AuditRefused(s.st, req.UserID, "refused push",
+		map[string]any{"repo": repo.Path(), "refs": refs, "reason": msg})
+	enc.Encode(Response{Allow: false, Message: msg})
 }
 func (s *Server) preReceive(req Request, dec *json.Decoder, enc *json.Encoder) {
 		return
 	}
 	if msg := policy.CheckPush(repo, req.Updates); msg != "" {
-		enc.Encode(Response{Allow: false, Message: msg})
+		s.refusePush(enc, req, repo, msg)
 		return
 	}
 	if msg := s.releaseAnchors(repo, req.Updates); msg != "" {
-		enc.Encode(Response{Allow: false, Message: msg})
+		s.refusePush(enc, req, repo, msg)
 		return
 	}
 	if !repo.Settings.RequireSignedCommits {
 		}
 	}
 	if refusal != "" {
-		enc.Encode(Response{Allow: false, Message: refusal})
+		s.refusePush(enc, req, repo, refusal)
 		return
 	}
 	enc.Encode(Response{Allow: true})

internal/hookd/socket_test.go +58

	@@ -1,12 +1,15 @@
1	package hookd	1	package hookd
2		2
3	import (	3	import (
		4	"errors"
		5	"net"
4	"os"	6	"os"
5	"path/filepath"	7	"path/filepath"
6	"strings"	8	"strings"
7	"testing"	9	"testing"
8		10
9	"gitbay.org/gitbay/internal/config"	11	"gitbay.org/gitbay/internal/config"
		12	"gitbay.org/gitbay/internal/policy"
10	"gitbay.org/gitbay/internal/store"	13	"gitbay.org/gitbay/internal/store"
11	)	14	)
12		15
	@@ -103,3 +106,58 @@ func TestHookRequestNeedsItsPushToken(t *testing.T) {
103	t.Fatalf("finished push: %+v, %v", resp, err)	106	t.Fatalf("finished push: %+v, %v", resp, err)
104	}	107	}
105	}	108	}
		109
		110	func refusedRows(t testing.T, st store.Store, action string) []store.AuditEntry {
		111	t.Helper()
		112	rows, err := st.AuditEntries(store.AuditFilter{ActionPrefix: action, Limit: 10})
		113	if err != nil {
		114	t.Fatal(err)
		115	}
		116	return rows
		117	}
		118
		119	// Refused hook requests and refused pushes are audited; the token never
		120	// lands in a row (#275).
		121	func TestHookRefusalsAreAudited(t *testing.T) {
		122	sock, st, repoID, uid := serveSocket(t)
		123
		124	forged := Request{Hook: "pre-receive", RepoID: repoID, UserID: uid, Scope: "full", Token: "not-a-live-token"}
		125	if resp, err := Ask(sock, forged, nil); err != nil \|\| resp.Allow {
		126	t.Fatalf("forged: %+v, %v", resp, err)
		127	}
		128	rows := refusedRows(t, st, "refused hook")
		129	if len(rows) != 1 \|\| rows[0].Actor != "" \|\| strings.Contains(rows[0].Data, forged.Token) \|\|
		130	!strings.Contains(rows[0].Data, "not started by this server") \|\| !strings.Contains(rows[0].Data, `"hook":"pre-receive"`) {
		131	t.Fatalf("refused hook rows: %+v", rows)
		132	}
		133
		134	token, err := st.CreatePushToken(repoID, uid, "full")
		135	if err != nil {
		136	t.Fatal(err)
		137	}
		138	req := Request{Hook: "pre-receive", RepoID: repoID, UserID: uid, Scope: "full", Token: token,
		139	Updates: []policy.RefUpdate{{Ref: "refs/merge-requests/1/head", Old: zeroSHA40, New: strings.Repeat("a", 40)}}}
		140	if resp, err := Ask(sock, req, nil); err != nil \|\| resp.Allow {
		141	t.Fatalf("push to a server-owned ref: %+v, %v", resp, err)
		142	}
		143	rows = refusedRows(t, st, "refused push")
		144	if len(rows) != 1 \|\| rows[0].Actor != "alice" \|\| strings.Contains(rows[0].Data, token) \|\|
		145	!strings.Contains(rows[0].Data, "alice/app") \|\| !strings.Contains(rows[0].Data, "refs/merge-requests/1/head") {
		146	t.Fatalf("refused push rows: %+v", rows)
		147	}
		148	}
		149
		150	// A connection from another uid is audited with no actor.
		151	func TestPeerRefusalIsAudited(t *testing.T) {
		152	old := peerCheck
		153	peerCheck = func(net.Conn) error { return errors.New("peer uid not permitted") }
		154	t.Cleanup(func() { peerCheck = old })
		155	sock, st, repoID, uid := serveSocket(t)
		156	if resp, err := Ask(sock, Request{Hook: "pre-receive", RepoID: repoID, UserID: uid}, nil); err != nil \|\| resp.Allow {
		157	t.Fatalf("refused peer: %+v, %v", resp, err)
		158	}
		159	rows := refusedRows(t, st, "refused hook")
		160	if len(rows) != 1 \|\| rows[0].Actor != "" \|\| !strings.Contains(rows[0].Data, "peer uid not permitted") {
		161	t.Fatalf("refused hook rows: %+v", rows)
		162	}
		163	}

Commit ead6796abe

Commit `ead6796abe`