src/hg-ssh
author Paul Crowley <paul@lshift.net>
Thu, 12 Nov 2009 11:19:36 +0000
changeset 208 31e862df1884
parent 165 3606d60b07e5
child 211 0cd59649772c
permissions -rwxr-xr-x
Added tag release_0.9 for changeset fed42d3f5311
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     1
#!/usr/bin/env python
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     2
#
50
77d97aa18f29 update dates and copyright notices
Paul Crowley <paul@lshift.net>
parents: 46
diff changeset
     3
# Copyright 2008-2009 LShift Ltd
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     4
# Copyright 2005-2007 by Intevation GmbH <intevation@intevation.de>
18
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
     5
# Authors:
4
dcd195f3e52c move config out of Python files; don't make hg-ssh-wrapper a dotfile;
Paul Crowley <paul@lshift.net>
parents: 0
diff changeset
     6
# Paul Crowley <paul@lshift.net>
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     7
# Thomas Arendsen Hein <thomas@intevation.de>
4
dcd195f3e52c move config out of Python files; don't make hg-ssh-wrapper a dotfile;
Paul Crowley <paul@lshift.net>
parents: 0
diff changeset
     8
# with ideas from  Mathieu PASQUET <kiorky@cryptelium.net>
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     9
#
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    10
# This software may be used and distributed according to the terms
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    11
# of the GNU General Public License, incorporated herein by reference.
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    12
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    13
"""
10
524b4a45ef0a wrap overlong lines
Paul Crowley <paul@lshift.net>
parents: 7
diff changeset
    14
hg-ssh - limit access to hg repositories reached via ssh.  Part of
36
b3237aabd0fe Change the name to mercurial-server
Paul Crowley <paul@lshift.net>
parents: 33
diff changeset
    15
mercurial-server.
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    16
18
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    17
This script is called by hg-ssh-wrapper with no arguments - everything
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    18
should be in enviroment variables:
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    19
39
f5055ce263c7 New system. No breaking in, just putting files in /etc/mercurial-server
Paul Crowley <paul@lshift.net>
parents: 36
diff changeset
    20
HG_ACCESS_RULES_PATH identifies the paths to the rule files
18
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    21
REMOTE_USER the remote user (which is the key used by ssh)
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    22
SSH_ORIGINAL_COMMAND the command the user was trying to run
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    23
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    24
It uses SSH_ORIGINAL_COMMAND to determine what the user was trying to
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    25
do and to what repository, and then checks each rule in the rule file
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    26
in turn for a matching rule which decides what to do, defaulting to
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    27
disallowing the action.
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    28
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    29
"""
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    30
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    31
# enable importing on demand to reduce startup time
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    32
from mercurial import demandimport; demandimport.enable()
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    33
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    34
from mercurial import dispatch
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    35
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    36
import sys, os, os.path
107
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    37
import base64
70
abb9ed8972e0 Move more into hg-ssh
Paul Crowley <paul@lshift.net>
parents: 69
diff changeset
    38
from mercurialserver import ruleset, paths
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    39
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    40
def fail(message):
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    41
    sys.stderr.write("mercurial-server: %s\n" % message)
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    42
    sys.exit(-1)
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    43
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    44
def checkDots(path):
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    45
    head, tail = os.path.split(path)
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    46
    if tail.startswith("."):
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    47
        fail("paths cannot contain dot file components")
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    48
    if head:
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    49
        checkDots(head)
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    50
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    51
def checkParents(path):
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    52
    path = os.path.dirname(path)
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    53
    if path == "":
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    54
        return
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    55
    if os.path.exists(path + "/.hg"):
109
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    56
        fail("Cannot create repo under existing repo")
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    57
    checkParents(path)
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    58
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    59
def getrepo(op, repo):
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    60
    # First canonicalise, then check the string, then the rules
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    61
    # and finally the filesystem.
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    62
    repo = repo.rstrip("/")
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    63
    if len(repo) == 0:
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    64
        fail("path to repository seems to be empty")
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    65
    if repo.startswith("/"):
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    66
        fail("absolute paths are not supported")
117
b6b8a5daf0f4 fix call to checkDots
Paul Crowley <paul@lshift.net>
parents: 110
diff changeset
    67
    checkDots(repo)
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    68
    ruleset.rules.set(repo=repo)
109
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    69
    if not ruleset.rules.allow(op, branch=None, file=None):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    70
        fail("access denied")
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    71
    checkParents(repo)
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    72
    return repo
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    73
107
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    74
paths.setExePath()
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    75
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    76
if len(sys.argv) == 3 and sys.argv[1] == "--base64":
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    77
    ruleset.rules.set(user = base64.b64decode(sys.argv[2]))
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    78
elif len(sys.argv) == 2:
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    79
    ruleset.rules.set(user = sys.argv[1])
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    80
else:
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    81
    fail("hg-ssh wrongly called, is authorized_keys corrupt? (%s)" 
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    82
        % sys.argv)
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    83
71
1120f78f81da Move more into hg-ssh
Paul Crowley <paul@lshift.net>
parents: 70
diff changeset
    84
# Use a different hgrc for remote pulls - this way you can set
1120f78f81da Move more into hg-ssh
Paul Crowley <paul@lshift.net>
parents: 70
diff changeset
    85
# up access.py for everything at once without affecting local operations
1120f78f81da Move more into hg-ssh
Paul Crowley <paul@lshift.net>
parents: 70
diff changeset
    86
165
3606d60b07e5 Use .mercurial-sever file instead of hardcoding
Paul Crowley <paul@lshift.net>
parents: 117
diff changeset
    87
os.environ['HGRCPATH'] = paths.getHgrcPaths()
71
1120f78f81da Move more into hg-ssh
Paul Crowley <paul@lshift.net>
parents: 70
diff changeset
    88
165
3606d60b07e5 Use .mercurial-sever file instead of hardcoding
Paul Crowley <paul@lshift.net>
parents: 117
diff changeset
    89
os.chdir(paths.getReposPath())
3606d60b07e5 Use .mercurial-sever file instead of hardcoding
Paul Crowley <paul@lshift.net>
parents: 117
diff changeset
    90
3606d60b07e5 Use .mercurial-sever file instead of hardcoding
Paul Crowley <paul@lshift.net>
parents: 117
diff changeset
    91
for f in paths.getAccessPaths():
77
8d14aac93b5d Most of the way through abolishing env vars
Paul Crowley <paul@lshift.net>
parents: 72
diff changeset
    92
    if os.path.isfile(f):
8d14aac93b5d Most of the way through abolishing env vars
Paul Crowley <paul@lshift.net>
parents: 72
diff changeset
    93
        ruleset.rules.readfile(f)
70
abb9ed8972e0 Move more into hg-ssh
Paul Crowley <paul@lshift.net>
parents: 69
diff changeset
    94
108
00b48d7bdfa0 Improve check on whether user supplied a command
Paul Crowley <paul@lshift.net>
parents: 107
diff changeset
    95
cmd = os.environ.get('SSH_ORIGINAL_COMMAND', None)
109
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    96
if cmd is None:
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    97
    fail("direct logins on the hg account prohibited")
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    98
elif cmd.startswith('hg -R ') and cmd.endswith(' serve --stdio'):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    99
    repo = getrepo("read", cmd[6:-14])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   100
    if not os.path.isdir(repo + "/.hg"):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   101
        fail("no such repository %s" % repo)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   102
    dispatch.dispatch(['-R', repo, 'serve', '--stdio'])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   103
elif cmd.startswith('hg init '):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   104
    repo = getrepo("init", cmd[8:])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   105
    if os.path.exists(repo):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   106
        fail("%s exists" % repo)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   107
    d = os.path.dirname(repo)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   108
    if d != "" and not os.path.isdir(d):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   109
        os.makedirs(d)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   110
    dispatch.dispatch(['init', repo])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   111
else:
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   112
    fail("illegal command %r" % cmd)
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
   113