83 lines
2.1 KiB
Python
83 lines
2.1 KiB
Python
import os, errno, re
|
|
import logging
|
|
|
|
log = logging.getLogger('gitosis.ssh')
|
|
|
|
_ACCEPTABLE_USER_RE = re.compile(r'^[a-zA-Z][a-zA-Z0-9_.-]*(@[a-zA-Z][a-zA-Z0-9.-]*)?$')
|
|
|
|
def isSafeUsername(user):
|
|
match = _ACCEPTABLE_USER_RE.match(user)
|
|
return (match is not None)
|
|
|
|
def readPrincipals(principals):
|
|
"""
|
|
Read SSH principals from ``principals``
|
|
"""
|
|
f = file(principals)
|
|
for line in f:
|
|
if not isSafeUsername(line):
|
|
log.warn('Unsafe SSH username in principalfile: %r', line)
|
|
continue
|
|
line = line.rstrip('\n')
|
|
yield (line)
|
|
f.close()
|
|
|
|
COMMENT = '### autogenerated by gitosis, DO NOT EDIT'
|
|
|
|
def generatePrincipals(keys):
|
|
TEMPLATE=('command="gitosis-serve %(user)s",no-port-forwarding,'
|
|
+'no-X11-forwarding,no-agent-forwarding,no-pty %(user)s')
|
|
|
|
yield COMMENT
|
|
for (user) in keys:
|
|
log.debug(TEMPLATE % dict(user=user))
|
|
yield TEMPLATE % dict(user=user)
|
|
|
|
_COMMAND_RE = re.compile('^command="(/[^ "]+/)?gitosis-serve [^"]+",no-port-forw'
|
|
+'arding,no-X11-forwarding,no-agent-forwardi'
|
|
+'ng,no-pty .*')
|
|
|
|
def filterPrincipals(fp):
|
|
"""
|
|
Read lines from ``fp``, filter out autogenerated ones.
|
|
|
|
Note removes newlines.
|
|
"""
|
|
|
|
for line in fp:
|
|
line = line.rstrip('\n')
|
|
if line == COMMENT:
|
|
continue
|
|
if _COMMAND_RE.match(line):
|
|
continue
|
|
yield line
|
|
|
|
def writePrincipals(path, principals):
|
|
tmp = '%s.%d.tmp' % (path, os.getpid())
|
|
try:
|
|
in_ = file(path)
|
|
except IOError, e:
|
|
if e.errno == errno.ENOENT:
|
|
in_ = None
|
|
else:
|
|
raise
|
|
|
|
try:
|
|
out = file(tmp, 'w')
|
|
try:
|
|
if in_ is not None:
|
|
for line in filterPrincipals(in_):
|
|
print >>out, line
|
|
|
|
keygen = readPrincipals(principals)
|
|
for line in generatePrincipals(keygen):
|
|
print >>out, line
|
|
|
|
os.fsync(out)
|
|
finally:
|
|
out.close()
|
|
finally:
|
|
if in_ is not None:
|
|
in_.close()
|
|
os.rename(tmp, path)
|