author | Paul Crowley <paul@lshift.net> |
Wed, 28 May 2008 18:14:15 +0100 | |
changeset 31 | d54720d47ca2 |
parent 23 | 9fa62cfd2821 |
child 32 | 4059dbe9f26a |
permissions | -rw-r--r-- |
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
1 |
# Copyright 2008 LShift Ltd |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
2 |
# Author(s): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
3 |
# Paul Crowley <paul@lshift.net> |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
4 |
# |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
5 |
# This software may be used and distributed according to the terms |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
6 |
# of the GNU General Public License, incorporated herein by reference. |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
7 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
8 |
import re |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
9 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
10 |
allowedchars = "A-Za-z0-9_-" |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
11 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
12 |
goodpathre = re.compile("([%s]+/)*[%s]+$" % (allowedchars, allowedchars)) |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
13 |
def goodpath(path): |
19
62ee928ac9b3
fixes following actual testing
Paul Crowley <paul@lshift.net>
parents:
18
diff
changeset
|
14 |
return goodpathre.match(path) is not None |
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
15 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
16 |
goodglobre = re.compile("[*/%s]+$" % allowedchars) |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
17 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
18 |
def goodglob(pattern): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
19 |
return goodglobre.match(pattern) is not None |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
20 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
21 |
# Don't put anything except *A-Za-z0-9_- in rule globs or |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
22 |
# it will match nothing. No regexp metachars, not even . |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
23 |
# We may fix this later. |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
24 |
def globmatcher(pattern): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
25 |
if not goodglob(pattern): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
26 |
#fail("Bad glob pattern in auth config: %s" % pattern) |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
27 |
# FIXME: report it somehow |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
28 |
return lambda x: False |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
29 |
# Substitution cunning so ** can be different from * |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
30 |
pattern = pattern.replace("*", "[]") |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
31 |
pattern = pattern.replace("[][]", "[/%s]*" % allowedchars) |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
32 |
pattern = pattern.replace("[]", "[%s]*" % allowedchars) |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
33 |
rex = re.compile(pattern + "$") |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
34 |
# None matches everything |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
35 |
return lambda x: x is None or rex.match(x) is not None |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
36 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
37 |
def rule(pairs): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
38 |
matchers = [(k, globmatcher(v)) for k, v in pairs] |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
39 |
def c(**kw): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
40 |
for k, m in matchers: |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
41 |
if k not in kw or not m(kw[k]): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
42 |
return False |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
43 |
return True |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
44 |
return c |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
45 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
46 |
class Ruleset(object): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
47 |
'''Class representing the rules in a rule file''' |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
48 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
49 |
levels = ["init", "write", "read", "deny"] |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
50 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
51 |
def __init__(self): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
52 |
self.rules = [] |
21
59540181a4bb
simplify by allowing some params to be preset in rules
Paul Crowley <paul@ciphergoth.org>
parents:
18
diff
changeset
|
53 |
self.preset = {} |
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
54 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
55 |
def add(self, action, conditions): |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
56 |
self.rules.append((action, conditions)) |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
57 |
|
21
59540181a4bb
simplify by allowing some params to be preset in rules
Paul Crowley <paul@ciphergoth.org>
parents:
18
diff
changeset
|
58 |
|
59540181a4bb
simplify by allowing some params to be preset in rules
Paul Crowley <paul@ciphergoth.org>
parents:
18
diff
changeset
|
59 |
def set(self, **kw): |
59540181a4bb
simplify by allowing some params to be preset in rules
Paul Crowley <paul@ciphergoth.org>
parents:
18
diff
changeset
|
60 |
self.preset.update(kw) |
59540181a4bb
simplify by allowing some params to be preset in rules
Paul Crowley <paul@ciphergoth.org>
parents:
18
diff
changeset
|
61 |
|
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
62 |
def matchrule(self, **kw): |
21
59540181a4bb
simplify by allowing some params to be preset in rules
Paul Crowley <paul@ciphergoth.org>
parents:
18
diff
changeset
|
63 |
d = self.preset.copy() |
59540181a4bb
simplify by allowing some params to be preset in rules
Paul Crowley <paul@ciphergoth.org>
parents:
18
diff
changeset
|
64 |
d.update(**kw) |
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
65 |
for a, c in self.rules: |
21
59540181a4bb
simplify by allowing some params to be preset in rules
Paul Crowley <paul@ciphergoth.org>
parents:
18
diff
changeset
|
66 |
if c(**d): |
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
67 |
return a |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
68 |
return None |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
69 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
70 |
def allow(self, level, **kw): |
19
62ee928ac9b3
fixes following actual testing
Paul Crowley <paul@lshift.net>
parents:
18
diff
changeset
|
71 |
a = self.matchrule(**kw) |
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
72 |
return a in self.levels and self.levels.index(a) <= self.levels.index(level) |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
73 |
|
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
74 |
@classmethod |
19
62ee928ac9b3
fixes following actual testing
Paul Crowley <paul@lshift.net>
parents:
18
diff
changeset
|
75 |
def readfile(cls, fn): |
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
76 |
res = cls() |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
77 |
f = open(fn) |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
78 |
try: |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
79 |
for l in f: |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
80 |
l = l.strip() |
19
62ee928ac9b3
fixes following actual testing
Paul Crowley <paul@lshift.net>
parents:
18
diff
changeset
|
81 |
if len(l) == 0 or l.startswith("#"): |
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
82 |
continue |
19
62ee928ac9b3
fixes following actual testing
Paul Crowley <paul@lshift.net>
parents:
18
diff
changeset
|
83 |
l = l.split() |
18
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
84 |
res.add(l[0], rule([c.split("=", 1) for c in l[1:]])) |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
85 |
finally: |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
86 |
f.close() |
538d6b198f4a
Big change to support file conditions; format of hg-ssh-access.conf
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
87 |
return res |