Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
executable file 160 lines (126 sloc) 5.22 KB
#!/usr/bin/env python
import os
import shlex
import sys
from twisted.conch.avatar import ConchUser
from twisted.conch.checkers import SSHPublicKeyDatabase
from twisted.conch.error import ConchError
from twisted.conch.ssh import common
from twisted.conch.ssh.session import (ISession,
SSHSession,
SSHSessionProcessProtocol)
from twisted.conch.ssh.factory import SSHFactory
from twisted.conch.ssh.keys import Key
from twisted.cred.portal import IRealm, Portal
from twisted.internet import reactor
from twisted.python import components, log
from zope import interface
log.startLogging(sys.stderr)
class IGitMetadata(interface.Interface):
'API for authentication and access control.'
def repopath(self, username, reponame):
'''
Given a username and repo name, return the full path of the repo on
the file system.
'''
def pubkeys(self, username):
'''
Given a username return a list of OpenSSH compatible public key
strings.
'''
BSHIPK = r'ssh-dss AAAAB3NzaC1kc3MAAACBAJW6g6QMZ7n7SJG3WBUcMTlgYJiuX61CPOMQj0F3srftuB81T5Y7r7T72zsov81crIi+PU5GRO80Umhu68nSPQmfXmYzkqNgU0XFHXuZXYnCW9l6hxn94Qr+XBPZMLwHUQvVzaFneFuFXS0Lx3iKa3HH43OOCjDkDnLVx39rvvUdAAAAFQCEBsryZKy+t8iNwGjKd4Q34F2T/wAAAIAV0CwoJHYCks4WXKTOLA080JaeFwBQEBJZgi5itrHMZJpISPQNrXV7EUTTMYLk5m4rWdiWYX24Witbu8VBwrRW8FMqLpd1x5fXvJrfqFxcJryASl6fCM3PVSmRgRMiJ1MyqKfovjur959k7LEtQsMEDgMnDgBwawHy8t38fMA7rwAAAIAEqVDoUOoZHr6l0Q/I+YpbZiCj1c6Ny5tfl+fy5bt2Ab6I7R3bUMUM2I5ycpGgFpIU96JiXbA35ga7VXOCn5qmAOjOk4DtmGIomi+z4k6kViQr1IFAb366Dyh/CV/Dkm7b9klugjZW/xsiBibS5kgTD1eFxbvvW10a8+8iJLgoiQ== bshi@Bo-Shis-MacBook-Pro.local'
class BallinMockMeta(object):
'Mock persistence layer.'
interface.implements(IGitMetadata)
# To test, you need to fill in pubkeys sequences with real public keys.
def __init__(self):
self.db = {
'jane': {
'pubkeys': ('a', 'b'),
'repos': {
'/foobar.git': '/path/to/foobar.git',
'/project.git': '/path/to/project.git',
},
},
'john': {
'pubkeys': ('c', 'd'),
'repos': {
'/helloworld.git': '/path/to/helloworld.git',
},
},
'bshi': {
'pubkeys': (BSHIPK,),
'repos': {
'/poop.git': '/Users/bshi/sandbox/poop/',
},
}
}
def repopath(self, username, reponame):
if username not in self.db:
return None
return self.db[username]['repos'].get(reponame, None)
def pubkeys(self, username):
if username not in self.db:
return None
return self.db[username]['pubkeys']
def find_git_shell():
# Find git-shell path.
# Adapted from http://bugs.python.org/file15381/shutil_which.patch
path = os.environ.get("PATH", os.defpath)
for dir in path.split(os.pathsep):
full_path = os.path.join(dir, 'git-shell')
if (os.path.exists(full_path) and
os.access(full_path, (os.F_OK | os.X_OK))):
return full_path
raise Exception('Could not find git executable!')
class GitSession(object):
interface.implements(ISession)
def __init__(self, user):
self.user = user
def execCommand(self, proto, cmd):
argv = shlex.split(cmd)
reponame = argv[-1]
sh = self.user.shell
# Check permissions by mapping requested path to file system path
repopath = self.user.meta.repopath(self.user.username, reponame)
if repopath is None:
raise ConchError('Invalid repository.')
command = ' '.join(argv[:-1] + ["'%s'" % (repopath,)])
reactor.spawnProcess(proto, sh,(sh, '-c', command))
def eofReceived(self): pass
def closed(self): pass
class GitConchUser(ConchUser):
shell = find_git_shell()
def __init__(self, username, meta):
ConchUser.__init__(self)
self.username = username
self.channelLookup.update({"session": SSHSession})
self.meta = meta
def logout(self): pass
class GitRealm(object):
interface.implements(IRealm)
def __init__(self, meta):
self.meta = meta
def requestAvatar(self, username, mind, *interfaces):
user = GitConchUser(username, self.meta)
return interfaces[0], user, user.logout
class GitPubKeyChecker(SSHPublicKeyDatabase):
def __init__(self, meta):
self.meta = meta
def checkKey(self, credentials):
for k in self.meta.pubkeys(credentials.username):
if Key.fromString(k).blob() == credentials.blob:
return True
return False
class GitServer(SSHFactory):
authmeta = BallinMockMeta()
portal = Portal(GitRealm(authmeta))
portal.registerChecker(GitPubKeyChecker(authmeta))
def __init__(self, privkey):
pubkey = '.'.join((privkey, 'pub'))
self.privateKeys = {'ssh-rsa': Key.fromFile(privkey)}
self.publicKeys = {'ssh-rsa': Key.fromFile(pubkey)}
if __name__ == '__main__':
components.registerAdapter(GitSession, GitConchUser, ISession)
reactor.listenTCP(2222, GitServer(sys.argv[1]))
reactor.run()