summaryrefslogtreecommitdiff
path: root/src/samizdat-ssh-command
blob: 79053fd743c1385526d8b15e3d48fdd3acab4758 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
#!/bin/dash
default_command="$HOME/samizdat-default-command"
if ! [ "$default_command" ] || ! [ -e "$default_command" ]
then
  default_command=password_authentication
fi

authorize()
{
  local authtype authdata forced_command comment authorized_keys_line
  [ "$SSH_USER_AUTH" -a -f "$SSH_USER_AUTH" ] || return
  read authtype authdata < "$SSH_USER_AUTH" || return
  [ "$authtype" = publickey ] || return

  forced_command="command=\"${0} authorize-full-access\",no-port-forwarding"
  comment="samizdat: password-authenticated from ${SSH_CONNECTION%% *}"

  authorized_keys_line="$forced_command $authdata $comment"
  sentinel='Samizdat - YES WE CAN'

  su - "$USER" -c 'mkdir -p "$HOME"/.ssh; touch "$HOME"/.ssh/authorized_keys' &&
  add_before_sentinel "$sentinel" \
                      "$authorized_keys_line" \
                      "$HOME"/.ssh/authorized_keys
}

add_before_sentinel()
{
    local sentinel="$1" add_me="$2" target="$3"
    sed -i.samizdat~ \
        -e "/$sentinel/i $add_me" \
        "$target"
}

password_authentication()
{
  [ "$USER" ] || { echo 'Error: no $USER' >&2; exit 1; }
  [ "$SSH_CLIENT_FINGERPRINT" ] || { echo 'Error: no $SSH_CLIENT_FINGERPRINT' >&2; exit 1; }

  tty=$(tty) && [ "$tty" != 'not a tty' ] || tty=

  if [ "$SSH_ORIGINAL_COMMAND" ]; then
    msg='You are not authorized to execute the command: %s\n'
    if ! [ "$tty" ]; then
      msg="$msg"'To authorize your public key via password, reconnect without a command, or with a terminal attached.\n'
      msg="$msg"'To attach a terminal, use the "-t" option to ssh.\n'
    else
      msg="$msg"'To authorize your public key and execute the command, enter your password.\n'
    fi
    printf "\n$msg\n" "$SSH_ORIGINAL_COMMAND" >&2
    if ! [ "$tty" ]; then
      exit 1
    fi
  else
    msg='You are not authorized to log in.\n'
    msg="$msg"'To authorize your public key and log in, enter your password.\n'
    printf "\n$msg\n" >&2
  fi
  authorize || exit $?
  # TODO: blacklist after too many authentication failures
  if [ "$SSH_ORIGINAL_COMMAND" ]; then
    exec "$SSH_ORIGINAL_COMMAND"
  else
    exec $(getent passwd "$USER"|cut -d: -f7) -i
  fi
  exit $? # exec failed
}

die() { echo "Error: $*" >&2; exit 1; }

dequote()
{
 # Sorry about the slashes.  The perl would be: s{ \\(.) | '([^']+)' }{ $1$2 }gx
  git_dir=$(echo -n "$git_dir" | sed -e "s/\\\\\\(.\\)\\|'\\([^']\\+\\)'/\\1\\2/g")
}

homedir_expand()
{
  git_dir=$(homedir_expand_arg "$git_dir") &&
    [ "$git_dir" ] || die "Could not expand home directory.  HOME=$HOME, USER=$USER, id=$(id)"
}

homedir_expand_arg()
{
  [ "$HOME" ] || die '$HOME is not set.'
  case "$1" in
      \~) echo "$HOME";;
    \~/*) echo "${HOME}${1#\~}";;
     \~*)
          local u
          u=${1#\~}
          u=${u%%/*}
          u=$(getent passwd "$u"|cut -f6 -d:) && [ "$u" ] || return 1
          echo "$u/${1#*/}";;
      /*) echo "$1";;
       *) echo "$HOME/$1";;
  esac
}

initialize_git()
{
  local git_dir="$1" anonymous="$2"
  if ! [ -e "$git_dir" ]; then
    mkdir -p "$(dirname "$git_dir")"
    git init --bare "$git_dir" >&2
    if [ "$anonymous" ]; then
      git --git-dir "$git_dir" config samizdat.allow-anonymous-access true
      git --git-dir "$git_dir" config samizdat.anonymous-ssh-owner "$anonymous"
    fi
  fi
}

is_gitdir() { git rev-parse --resolve-git-dir "$1" >/dev/null 2>&1; }

deny() { echo 'Error: permission denied.' >&2; exit 1; }

valid_new_public_repo()
{
  local git_dir="$1"
  [ ! -e "$git_dir" ] || return
  [ "$HOME" -a -d "$HOME"/public_git ] || return
  local dirname="$(dirname "$git_dir")"

  case "$git_dir" in
    *.git) ;;
    *)
      echo 'Error: public repos must be named *.git' >&2
      return 1 ;;
  esac

  case "$dirname" in
    $HOME/public_git) return 0 ;;
    $HOME/public_git/*)
      # Ensure that no parent directory is named *.git
      # Also enforce a maximum depth of 4.
      # Valid:   public_git/a/b/c/d.git
      # Invalid: public_git/a/b/c/d/e.git
      local n relative="${git_dir#$HOME/public_git/}"
      for n in 1 2 3 4; do
        local topmost="${relative%%/*}"
        case "$topmost" in
          "$relative") return 0;;
          *.git) return 1;;
        esac
        relative=${relative#$topmost/}
      done
      echo 'Error: directories nest too deep' >&2
      return 1
    ;;
    *) return 1 ;;
  esac
}

check_if_ssh_user_owns_repository()
{
  git --git-dir "$git_dir" config --get-all samizdat.anonymous-ssh-owner | grep -xqF "$SSH_CLIENT_FINGERPRINT"
}
ssh_user_owns_repository()
{
  if [ -z "$SSH_USER_OWNS_REPOSITORY" ]; then
    check_if_ssh_user_owns_repository
    SSH_USER_OWNS_REPOSITORY=$?
  fi
  return $SSH_USER_OWNS_REPOSITORY
}

is_public_repository()
{
  case "$git_dir" in
    */../*) false;;
    "$HOME"/public_git/*) true;;
    *) false;;
  esac
}

authorized()
{
  # TODO: check SSH_CLIENT_FINGERPRINT against a blacklist
  ssh_user_owns_repository && return
  is_public_repository && return
  test "$(git --git-dir "$1" config --bool --get samizdat.allow-anonymous-access)" = true 2>/dev/null && return 0
  # TODO: check SSH_CLIENT_FINGERPRINT against a whitelist
}

maybe_initialize_heads()
{
  [ "$GIT_NAMESPACE" ] || die 'Programmer error'
  heads=$git_dir/refs/namespaces/$GIT_NAMESPACE/refs/heads
  mkdir -p "$heads"
  found_file=$(find "$heads" -type f -print -quit)
  [ "$found_file" ] && return
  [ -e "$git_dir/refs/heads/master" ] && cp "$git_dir/refs/heads/master" "$heads"
  # TODO: copy actual file 'HEAD' and whatever it references
}


if [ "$1" = "authorize-full-access" ]; then
  case "$SSH_ORIGINAL_COMMAND" in
    git-receive-pack\ *)
     git_cmd=git-receive-pack
     git_dir="${SSH_ORIGINAL_COMMAND#git-receive-pack }"
     dequote
     homedir_expand
     initialize_git "$git_dir"
     exec "$git_cmd" "$git_dir"
    ;;
    "")
      shell=$(getent passwd $USER|cut -d: -f7)
      argv0=-${shell##*/}
      if which chpst >/dev/null 2>&1; then
        exec chpst -b "$argv0" "$shell"
      else
        exec "$shell"
      fi
    ;;
    *)
      exec /bin/sh -c "$SSH_ORIGINAL_COMMAND"
    ;;
  esac
  exit
fi

eval "$(samizdat-ssh-uid)" || die eval

# TODO: call password_authentication on all authorization failures

#echo "SSH_ORIGINAL_COMMAND=$SSH_ORIGINAL_COMMAND" >&2
case "$SSH_ORIGINAL_COMMAND" in
  git-upload-pack\ *|git-receive-pack\ *)
    # set three variables
    # 1. git_cmd
    # 2. git_dir
    # 3. git_ns (optional)

    git_cmd=${SSH_ORIGINAL_COMMAND%%\ *}
    git_dir=${SSH_ORIGINAL_COMMAND#*\ }

    dequote
    homedir_expand

    case "$git_dir" in
      $HOME/git_namespace/*/public_git/*)
        git_ns_subdir=${git_dir#$HOME/git_namespace/}
        git_ns=${git_ns_subdir%%/*}
        git_dir=$HOME/${git_ns_subdir#*/}
      ;;
    esac

  ;;
  rsync\ --server\ --sender\ -de.LsfxC\ .\ public_git/|rsync\ --server\ --sender\ -de.LsfxC\ .\ public_git/|rsync\ --server\ --sender\ -de.Lsf\ .\ public_git/)
    #echo "$SSH_ORIGINAL_COMMAND" >&2
    [ -d "$HOME"/public_git ] || { password_authentication; exit 1; }
    exec $SSH_ORIGINAL_COMMAND
    #exec rrsync -ro "$HOME"/public_git
    exit 1
  ;;
  rsync\ --server\ --sender\ *)
    #echo "$SSH_ORIGINAL_COMMAND" >&2
    [ -d "$HOME"/public_rsync ] || { password_authentication; exit 1; }
    exec rrsync -ro "$HOME"/public_rsync
    exit 1
  ;;
  rsync\ --server\ *)
    [ -d "$HOME"/incoming_rsync -a "${SSH_CLIENT_FINGERPRINT}" ] || { password_authentication; exit 1; }
    destdir=$HOME/incoming_rsync/$SSH_CLIENT_FINGERPRINT/
    mkdir -p "$destdir" && exec rrsync "$destdir"
    exit 1
  ;;
  *)
    #password_authentication
    $default_command
    exit
  ;;
esac

if [ "$git_cmd" = 'git-upload-pack' ]; then
  case "$git_dir" in
    $HOME/public_git/*|public_git/*)
      is_gitdir "$git_dir" || git_dir="$git_dir/.git"
      if ! is_gitdir "$git_dir"; then
    #   git rev-parse --resolve-git-dir "${git_dir%/.git}" # show git's error message
        deny
      fi
      if [ "$git_ns" -a -e "$git_dir/refs/namespaces/$git_ns" ]; then
        export GIT_NAMESPACE="$git_ns"
        # maybe_initialize_heads
      fi
      exec "$git_cmd" "$git_dir"
      ;;
  esac

elif [ "$git_cmd" = 'git-receive-pack' ]; then

  if [ ! -d "$git_dir" ]; then
    if valid_new_public_repo "$git_dir"; then
      initialize_git "$git_dir" "$SSH_CLIENT_FINGERPRINT"
    else
      deny
    fi
  fi

fi

if authorized "$git_dir"; then
  if [ "$git_cmd" = 'git-receive-pack' ]; then
    if ! ssh_user_owns_repository
    then
      export GIT_NAMESPACE="$SSH_CLIENT_FINGERPRINT"
      maybe_initialize_heads
      printf '%s:%s\n' 'd@cryptonomic.net' "git_namespace/$GIT_NAMESPACE/${git_dir#${HOME}/}" >&2
    fi
  fi
  exec "$git_cmd" "$git_dir"
else
  $default_command
  exit
  # echo 'Error: git access is unauthorized' >&2; exit 1 # unreached
fi