src/hg-ssh
author Paul Crowley <paul@lshift.net>
Tue, 15 Dec 2009 15:36:08 +0000
changeset 237 d30f3f312ece
parent 236 38cea4b518c1
child 242 03d8f07230b3
permissions -rwxr-xr-x
Handle maybe matches properly
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     1
#!/usr/bin/env python
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     2
#
50
77d97aa18f29 update dates and copyright notices
Paul Crowley <paul@lshift.net>
parents: 46
diff changeset
     3
# Copyright 2008-2009 LShift Ltd
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     4
# Copyright 2005-2007 by Intevation GmbH <intevation@intevation.de>
18
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
     5
# Authors:
4
dcd195f3e52c move config out of Python files; don't make hg-ssh-wrapper a dotfile;
Paul Crowley <paul@lshift.net>
parents: 0
diff changeset
     6
# Paul Crowley <paul@lshift.net>
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     7
# Thomas Arendsen Hein <thomas@intevation.de>
4
dcd195f3e52c move config out of Python files; don't make hg-ssh-wrapper a dotfile;
Paul Crowley <paul@lshift.net>
parents: 0
diff changeset
     8
# with ideas from  Mathieu PASQUET <kiorky@cryptelium.net>
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     9
#
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    10
# This software may be used and distributed according to the terms
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    11
# of the GNU General Public License, incorporated herein by reference.
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    12
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    13
"""
10
524b4a45ef0a wrap overlong lines
Paul Crowley <paul@lshift.net>
parents: 7
diff changeset
    14
hg-ssh - limit access to hg repositories reached via ssh.  Part of
36
b3237aabd0fe Change the name to mercurial-server
Paul Crowley <paul@lshift.net>
parents: 33
diff changeset
    15
mercurial-server.
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    16
214
7374d0147875 Script docstring was full of lies - now up to date
Paul Crowley <paul@lshift.net>
parents: 212
diff changeset
    17
It is called by ssh due to an entry in the authorized_keys file,
7374d0147875 Script docstring was full of lies - now up to date
Paul Crowley <paul@lshift.net>
parents: 212
diff changeset
    18
with the name for the key passed on the command line.
18
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    19
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    20
It uses SSH_ORIGINAL_COMMAND to determine what the user was trying to
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    21
do and to what repository, and then checks each rule in the rule file
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    22
in turn for a matching rule which decides what to do, defaulting to
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    23
disallowing the action.
538d6b198f4a Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents: 15
diff changeset
    24
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    25
"""
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    26
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    27
# enable importing on demand to reduce startup time
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    28
from mercurial import demandimport; demandimport.enable()
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    29
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    30
from mercurial import dispatch
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    31
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    32
import sys, os, os.path
107
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    33
import base64
211
0cd59649772c Rename paths.py ot config.py
Paul Crowley <paul@lshift.net>
parents: 165
diff changeset
    34
from mercurialserver import config, ruleset
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    35
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    36
def fail(message):
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    37
    sys.stderr.write("mercurial-server: %s\n" % message)
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    38
    sys.exit(-1)
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    39
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    40
def checkDots(path):
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    41
    head, tail = os.path.split(path)
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    42
    if tail.startswith("."):
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    43
        fail("paths cannot contain dot file components")
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    44
    if head:
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    45
        checkDots(head)
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    46
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    47
def checkParents(path):
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    48
    path = os.path.dirname(path)
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    49
    if path == "":
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    50
        return
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    51
    if os.path.exists(path + "/.hg"):
109
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    52
        fail("Cannot create repo under existing repo")
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    53
    checkParents(path)
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    54
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    55
def getrepo(op, repo):
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    56
    # First canonicalise, then check the string, then the rules
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    57
    # and finally the filesystem.
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    58
    repo = repo.rstrip("/")
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    59
    if len(repo) == 0:
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    60
        fail("path to repository seems to be empty")
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    61
    if repo.startswith("/"):
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    62
        fail("absolute paths are not supported")
117
b6b8a5daf0f4 fix call to checkDots
Paul Crowley <paul@lshift.net>
parents: 110
diff changeset
    63
    checkDots(repo)
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    64
    ruleset.rules.set(repo=repo)
109
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    65
    if not ruleset.rules.allow(op, branch=None, file=None):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    66
        fail("access denied")
110
69596fffcf7d Less canonicalisation, use os.path to check for dotfiles
Paul Crowley <paul@lshift.net>
parents: 109
diff changeset
    67
    checkParents(repo)
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    68
    return repo
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    69
217
32b431977bf9 Fix /home/paul if it's broken when we start
Paul Crowley <paul@lshift.net>
parents: 215
diff changeset
    70
config.initExe()
107
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    71
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    72
if len(sys.argv) == 3 and sys.argv[1] == "--base64":
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    73
    ruleset.rules.set(user = base64.b64decode(sys.argv[2]))
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    74
elif len(sys.argv) == 2:
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    75
    ruleset.rules.set(user = sys.argv[1])
84e9e33d866b Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents: 106
diff changeset
    76
else:
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
    77
    fail("hg-ssh wrongly called, is authorized_keys corrupt? (%s)" 
0
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    78
        % sys.argv)
41ecb5a3172c separate out executables and data
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    79
215
584df0f2e5c7 Use ConfigParser istead of mercurial.config
Paul Crowley <paul@lshift.net>
parents: 214
diff changeset
    80
for k,v in config.getEnv():
236
38cea4b518c1 Aargh, ConfigParser smashes case, breaking security
Paul Crowley <paul@lshift.net>
parents: 217
diff changeset
    81
    os.environ[k.upper()] = v
71
1120f78f81da Move more into hg-ssh
Paul Crowley <paul@lshift.net>
parents: 70
diff changeset
    82
211
0cd59649772c Rename paths.py ot config.py
Paul Crowley <paul@lshift.net>
parents: 165
diff changeset
    83
os.chdir(config.getReposPath())
165
3606d60b07e5 Use .mercurial-sever file instead of hardcoding
Paul Crowley <paul@lshift.net>
parents: 117
diff changeset
    84
211
0cd59649772c Rename paths.py ot config.py
Paul Crowley <paul@lshift.net>
parents: 165
diff changeset
    85
for f in config.getAccessPaths():
77
8d14aac93b5d Most of the way through abolishing env vars
Paul Crowley <paul@lshift.net>
parents: 72
diff changeset
    86
    if os.path.isfile(f):
8d14aac93b5d Most of the way through abolishing env vars
Paul Crowley <paul@lshift.net>
parents: 72
diff changeset
    87
        ruleset.rules.readfile(f)
70
abb9ed8972e0 Move more into hg-ssh
Paul Crowley <paul@lshift.net>
parents: 69
diff changeset
    88
108
00b48d7bdfa0 Improve check on whether user supplied a command
Paul Crowley <paul@lshift.net>
parents: 107
diff changeset
    89
cmd = os.environ.get('SSH_ORIGINAL_COMMAND', None)
109
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    90
if cmd is None:
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    91
    fail("direct logins on the hg account prohibited")
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    92
elif cmd.startswith('hg -R ') and cmd.endswith(' serve --stdio'):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    93
    repo = getrepo("read", cmd[6:-14])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    94
    if not os.path.isdir(repo + "/.hg"):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    95
        fail("no such repository %s" % repo)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    96
    dispatch.dispatch(['-R', repo, 'serve', '--stdio'])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    97
elif cmd.startswith('hg init '):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    98
    repo = getrepo("init", cmd[8:])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
    99
    if os.path.exists(repo):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   100
        fail("%s exists" % repo)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   101
    d = os.path.dirname(repo)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   102
    if d != "" and not os.path.isdir(d):
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   103
        os.makedirs(d)
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   104
    dispatch.dispatch(['init', repo])
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   105
else:
72100d3ed1bd Don't mix exceptions and sys.exit based failures
Paul Crowley <paul@lshift.net>
parents: 108
diff changeset
   106
    fail("illegal command %r" % cmd)
106
0519745e7a57 Much less strict about most things
Paul Crowley <paul@lshift.net>
parents: 103
diff changeset
   107