src/hg-ssh
author Paul Crowley <paul@lshift.net>
Mon, 18 Apr 2011 13:26:05 +0100
changeset 303 3f9f247b72bd
parent 275 2e781d52f76e
child 304 6e575b602d2b
permissions -rwxr-xr-x
Allow mq clones
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     1
#!/usr/bin/env python
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     2
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     3
"""
10
524b4a45ef0a wrap overlong lines
Paul Crowley <paul@lshift.net>
parents: 7
diff changeset
     4
hg-ssh - limit access to hg repositories reached via ssh.  Part of
36
b3237aabd0fe Change the name to mercurial-server
Paul Crowley <paul@lshift.net>
parents: 33
diff changeset
     5
mercurial-server.
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     6
214
7374d0147875 Script docstring was full of lies - now up to date
Paul Crowley <paul@lshift.net>
parents: 212
diff changeset
     7
It is called by ssh due to an entry in the authorized_keys file,
7374d0147875 Script docstring was full of lies - now up to date
Paul Crowley <paul@lshift.net>
parents: 212
diff changeset
     8
with the name for the key passed on the command line.
18
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
     9
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    10
It uses SSH_ORIGINAL_COMMAND to determine what the user was trying to
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    11
do and to what repository, and then checks each rule in the rule file
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    12
in turn for a matching rule which decides what to do, defaulting to
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    13
disallowing the action.
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    14
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    15
"""
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    16
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    17
# enable importing on demand to reduce startup time
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    18
from mercurial import demandimport; demandimport.enable()
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    19
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    20
from mercurial import dispatch
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    21
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    22
import sys, os, os.path
107
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    23
import base64
211
0cd59649772c Rename paths.py ot config.py
Paul Crowley <paul@lshift.net>
parents: 165
diff changeset
    24
from mercurialserver import config, ruleset
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    25
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    26
def fail(message):
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    27
    sys.stderr.write("mercurial-server: %s\n" % message)
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    28
    sys.exit(-1)
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    29
303
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    30
config.initExe()
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    31
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    32
for k,v in config.getEnv():
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    33
    os.environ[k.upper()] = v
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    34
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    35
if len(sys.argv) == 3 and sys.argv[1] == "--base64":
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    36
    ruleset.rules.set(user = base64.b64decode(sys.argv[2]))
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    37
elif len(sys.argv) == 2:
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    38
    ruleset.rules.set(user = sys.argv[1])
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    39
else:
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    40
    fail("hg-ssh wrongly called, is authorized_keys corrupt? (%s)"
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    41
        % sys.argv)
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    42
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    43
os.chdir(config.getReposPath())
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    44
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    45
for f in config.getAccessPaths():
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    46
    if os.path.isfile(f):
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    47
        ruleset.rules.readfile(f)
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    48
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    49
alloweddots = config.getAllowedDots()
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    50
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    51
def dotException(pathtail):
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    52
    for ex in alloweddots:
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    53
        splex = ex.split("/")
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    54
        if len(pathtail) >= len(splex) and pathtail[:len(splex)] == splex:
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    55
            return True
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    56
    return False
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    57
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    58
def checkDots(path, pathtail = []):
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    59
    head, tail = os.path.split(path)
303
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    60
    pathtail = [tail] + pathtail
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    61
    if tail.startswith(".") and not dotException(pathtail):
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    62
            fail("paths cannot contain dot file components")
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    63
    if head:
303
3f9f247b72bd Allow mq clones
Paul Crowley <paul@lshift.net>
parents: 275
diff changeset
    64
        checkDots(head, pathtail)
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    65
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    66
def getrepo(op, repo):
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    67
    # First canonicalise, then check the string, then the rules
244
48fab30c38e1 Strip repo name in case of tortoiseHG
Paul Crowley <paul@lshift.net>
parents: 242
diff changeset
    68
    repo = repo.strip().rstrip("/")
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    69
    if len(repo) == 0:
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    70
        fail("path to repository seems to be empty")
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    71
    if repo.startswith("/"):
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    72
        fail("absolute paths are not supported")
117
b6b8a5daf0f4 fix call to checkDots
Paul Crowley <paul@lshift.net>
parents: 110
diff changeset
    73
    checkDots(repo)
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    74
    ruleset.rules.set(repo=repo)
109
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    75
    if not ruleset.rules.allow(op, branch=None, file=None):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    76
        fail("access denied")
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    77
    return repo
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    78
108
00b48d7bdfa0 Improve check on whether user supplied a command
Paul Crowley <paul@lshift.net>
parents: 107
diff changeset
    79
cmd = os.environ.get('SSH_ORIGINAL_COMMAND', None)
109
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    80
if cmd is None:
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    81
    fail("direct logins on the hg account prohibited")
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    82
elif cmd.startswith('hg -R ') and cmd.endswith(' serve --stdio'):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    83
    repo = getrepo("read", cmd[6:-14])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    84
    if not os.path.isdir(repo + "/.hg"):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    85
        fail("no such repository %s" % repo)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    86
    dispatch.dispatch(['-R', repo, 'serve', '--stdio'])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    87
elif cmd.startswith('hg init '):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    88
    repo = getrepo("init", cmd[8:])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    89
    if os.path.exists(repo):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    90
        fail("%s exists" % repo)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    91
    d = os.path.dirname(repo)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    92
    if d != "" and not os.path.isdir(d):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    93
        os.makedirs(d)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    94
    dispatch.dispatch(['init', repo])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    95
else:
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    96
    fail("illegal command %r" % cmd)