author | Paul Crowley <paul@lshift.net> |
Mon, 09 Nov 2009 17:13:37 +0000 (2009-11-09) | |
changeset 177 | fb6587ce93c6 |
parent 165 | 3606d60b07e5 |
child 211 | 0cd59649772c |
permissions | -rw-r--r-- |
74
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
1 |
# Copyright 2008-2009 LShift Ltd |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
2 |
|
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
3 |
# WARNING |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
4 |
# This hook completely destroys your ~/.ssh/authorized_keys |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
5 |
# file every time it is run |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
6 |
# WARNING |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
7 |
|
106
0519745e7a57
Much less strict about most things
Paul Crowley <paul@lshift.net>
parents:
86
diff
changeset
|
8 |
import re |
107
84e9e33d866b
Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents:
106
diff
changeset
|
9 |
import base64 |
74
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
10 |
import os |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
11 |
import os.path |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
12 |
import subprocess |
106
0519745e7a57
Much less strict about most things
Paul Crowley <paul@lshift.net>
parents:
86
diff
changeset
|
13 |
from mercurialserver import paths |
0519745e7a57
Much less strict about most things
Paul Crowley <paul@lshift.net>
parents:
86
diff
changeset
|
14 |
|
107
84e9e33d866b
Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents:
106
diff
changeset
|
15 |
goodkey = re.compile("[/A-Za-z0-9._-]+$") |
74
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
16 |
|
165
3606d60b07e5
Use .mercurial-sever file instead of hardcoding
Paul Crowley <paul@lshift.net>
parents:
107
diff
changeset
|
17 |
def refreshAuth(): |
3606d60b07e5
Use .mercurial-sever file instead of hardcoding
Paul Crowley <paul@lshift.net>
parents:
107
diff
changeset
|
18 |
akeyfile = os.path.expanduser("~/.ssh/authorized_keys") |
79 | 19 |
wrappercommand = paths.getExePath() + "/hg-ssh" |
74
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
20 |
prefix='no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command=' |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
21 |
|
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
22 |
if os.path.exists(akeyfile): |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
23 |
f = open(akeyfile) |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
24 |
try: |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
25 |
for l in f: |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
26 |
if not l.startswith(prefix): |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
27 |
raise Exception("Safety check failed, delete %s to continue" % akeyfile) |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
28 |
finally: |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
29 |
f.close() |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
30 |
|
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
31 |
akeys = open(akeyfile + "_new", "w") |
165
3606d60b07e5
Use .mercurial-sever file instead of hardcoding
Paul Crowley <paul@lshift.net>
parents:
107
diff
changeset
|
32 |
for keyroot in paths.getKeysPaths(): |
74
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
33 |
kr = keyroot + "/" |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
34 |
#print "Processing keyroot", keyroot |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
35 |
for root, dirs, files in os.walk(keyroot): |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
36 |
for fn in files: |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
37 |
ffn = os.path.join(root, fn) |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
38 |
if not ffn.startswith(kr): |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
39 |
raise Exception("Inconsistent behaviour in os.walk, bailing") |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
40 |
#print "Processing file", ffn |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
41 |
keyname = ffn[len(kr):] |
107
84e9e33d866b
Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents:
106
diff
changeset
|
42 |
if not goodkey.match(keyname): |
84e9e33d866b
Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents:
106
diff
changeset
|
43 |
# Encode it for safe quoting |
84e9e33d866b
Fixes, plus base64 what you don't trust
Paul Crowley <paul@lshift.net>
parents:
106
diff
changeset
|
44 |
keyname = "--base64 " + base64.b64encode(keyname) |
74
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
45 |
p = subprocess.Popen(("ssh-keygen", "-i", "-f", ffn), |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
46 |
stdout=subprocess.PIPE, stderr=subprocess.PIPE) |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
47 |
newkey = p.communicate()[0] |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
48 |
if p.wait() == 0: |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
49 |
klines = [l.strip() for l in newkey.split("\n")] |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
50 |
else: |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
51 |
# Conversion failed, read it directly. |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
52 |
kf = open(ffn) |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
53 |
try: |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
54 |
klines = [l.strip() for l in kf] |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
55 |
finally: |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
56 |
kf.close() |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
57 |
for l in klines: |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
58 |
if len(l): |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
59 |
akeys.write('%s"%s %s" %s\n' % (prefix, wrappercommand, keyname, l)) |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
60 |
akeys.close() |
9d2ae2841bf2
Move meat of do-refresh-auth into a module
Paul Crowley <paul@lshift.net>
parents:
diff
changeset
|
61 |
os.rename(akeyfile + "_new", akeyfile) |
75
5af89523a9d3
give refreshauth.py a hook and call that in hgadmin hgrc
Paul Crowley <paul@lshift.net>
parents:
74
diff
changeset
|
62 |
|
5af89523a9d3
give refreshauth.py a hook and call that in hgadmin hgrc
Paul Crowley <paul@lshift.net>
parents:
74
diff
changeset
|
63 |
def hook(ui, repo, hooktype, node=None, source=None, **kwargs): |
165
3606d60b07e5
Use .mercurial-sever file instead of hardcoding
Paul Crowley <paul@lshift.net>
parents:
107
diff
changeset
|
64 |
refreshAuth() |
75
5af89523a9d3
give refreshauth.py a hook and call that in hgadmin hgrc
Paul Crowley <paul@lshift.net>
parents:
74
diff
changeset
|
65 |