#
# Written by
# Jameson Rollins <jrollins@fifthhorseman.net>
+# Jamie McClelland <jm@mayfirst.org>
+# Daniel Kahn Gillmor <dkg@fifthhorseman.net>
#
# Copyright 2008, released under the GPL, version 3 or later
exit ${2:-'255'}
}
-# write output to stderr
+# write output to stderr based on specified LOG_LEVEL the first
+# parameter is the priority of the output, and everything else is what
+# is echoed to stderr
log() {
+ local priority
local level
+ local output
+ local alllevels
+ local found=
- level="$1"
+ # don't include SILENT in alllevels: it's handled separately
+ # list in decreasing verbosity (all caps).
+ # separate with $IFS explicitly, since we do some fancy footwork
+ # elsewhere.
+ alllevels="DEBUG${IFS}VERBOSE${IFS}INFO${IFS}ERROR"
+
+ # translate lowers to uppers in global log level
+ LOG_LEVEL=$(echo "$LOG_LEVEL" | tr "[:lower:]" "[:upper:]")
+
+ # just go ahead and return if the log level is silent
+ if [ "$LOG_LEVEL" = 'SILENT' ] ; then
+ return
+ fi
+
+ for level in $alllevels ; do
+ if [ "$LOG_LEVEL" = "$level" ] ; then
+ found=true
+ fi
+ done
+ if [ -z "$found" ] ; then
+ # default to INFO:
+ LOG_LEVEL=INFO
+ fi
+
+ # get priority from first parameter, translating all lower to
+ # uppers
+ priority=$(echo "$1" | tr "[:lower:]" "[:upper:]")
shift
- echo -n "ms: " >&2
- echo "$@" >&2
+ # scan over available levels
+ for level in $alllevels ; do
+ # output if the log level matches, set output to true
+ # this will output for all subsequent loops as well.
+ if [ "$LOG_LEVEL" = "$level" ] ; then
+ output=true
+ fi
+ if [ "$priority" = "$level" -a "$output" = 'true' ] ; then
+ echo -n "ms: " >&2
+ echo "$@" >&2
+ fi
+ done
}
# cut out all comments(#) and blank lines from standard input
head --line="$1" "$2" | tail -1
}
+# this is a wrapper for doing lock functions.
+#
+# it lets us depend on either lockfile-progs (preferred) or procmail's
+# lockfile, and should
+lock() {
+ local use_lockfileprogs=true
+ local action="$1"
+ local file="$2"
+
+ if ! ( which lockfile-create >/dev/null 2>/dev/null ) ; then
+ if ! ( which lockfile >/dev/null ); then
+ failure "Neither lockfile-create nor lockfile are in the path!"
+ fi
+ use_lockfileprogs=
+ fi
+
+ case "$action" in
+ create)
+ if [ -n "$use_lockfileprogs" ] ; then
+ lockfile-create "$file" || failure "unable to lock '$file'"
+ else
+ lockfile -r 20 "${file}.lock" || failure "unable to lock '$file'"
+ fi
+ ;;
+ touch)
+ if [ -n "$use_lockfileprogs" ] ; then
+ lockfile-touch --oneshot "$file"
+ else
+ : Nothing to do here
+ fi
+ ;;
+ remove)
+ if [ -n "$use_lockfileprogs" ] ; then
+ lockfile-remove "$file"
+ else
+ rm -f "${file}.lock"
+ fi
+ ;;
+ *)
+ failure "bad argument for lock subfunction '$action'"
+ esac
+}
+
+
+# for portability, between gnu date and BSD date.
+# arguments should be: number longunits format
+
+# e.g. advance_date 20 seconds +%F
+advance_date() {
+ local gnutry
+ local number="$1"
+ local longunits="$2"
+ local format="$3"
+ local shortunits
+
+ # try things the GNU way first
+ if date -d "$number $longunits" "$format" >&/dev/null ; then
+ date -d "$number $longunits" "$format"
+ else
+ # otherwise, convert to (a limited version of) BSD date syntax:
+ case "$longunits" in
+ years)
+ shortunits=y
+ ;;
+ months)
+ shortunits=m
+ ;;
+ weeks)
+ shortunits=w
+ ;;
+ days)
+ shortunits=d
+ ;;
+ hours)
+ shortunits=H
+ ;;
+ minutes)
+ shortunits=M
+ ;;
+ seconds)
+ shortunits=S
+ ;;
+ *)
+ # this is a longshot, and will likely fail; oh well.
+ shortunits="$longunits"
+ esac
+ date "-v+${number}${shortunits}" "$format"
+ fi
+}
+
+
# check that characters are in a string (in an AND fashion).
# used for checking key capability
# check_capability capability a [b...]
remove_line() {
local file
local string
+ local tempfile
file="$1"
string="$2"
# if the string is in the file...
if grep -q -F "$string" "$file" 2> /dev/null ; then
+ tempfile=$(mktemp "${file}.XXXXXXX") || \
+ failure "Unable to make temp file '${file}.XXXXXXX'"
+
# remove the line with the string, and return 0
- grep -v -F "$string" "$file" | sponge "$file"
+ grep -v -F "$string" "$file" >"$tempfile"
+ cat "$tempfile" > "$file"
+ rm "$tempfile"
return 0
# otherwise return 1
else
# remove all lines with MonkeySphere strings in file
remove_monkeysphere_lines() {
local file
+ local tempfile
file="$1"
return 1
fi
+ tempfile=$(mktemp "${file}.XXXXXXX") || \
+ failure "Could not make temporary file '${file}.XXXXXXX'."
+
egrep -v '^MonkeySphere[[:digit:]]{4}(-[[:digit:]]{2}){2}T[[:digit:]]{2}(:[[:digit:]]{2}){2}$' \
- "$file" | sponge "$file"
+ "$file" >"$tempfile"
+ cat "$tempfile" > "$file"
+ rm "$tempfile"
}
# translate ssh-style path variables %h and %u
# if the gpg query return code is not 0, return 1
if [ "$?" -ne 0 ] ; then
- log error " no primary keys found."
+ log verbose " no primary keys found."
return 1
fi
lastKeyOK=
fingerprint=
- log error " primary key found: $keyid"
+ log verbose " primary key found: $keyid"
# if overall key is not valid, skip
if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
# output a line for the primary key
# 0 = ok, 1 = bad
if [ "$keyOK" -a "$uidOK" -a "$lastKeyOK" ] ; then
- log error " * acceptable primary key."
+ log verbose " * acceptable primary key."
if [ -z "$sshKey" ] ; then
log error " ! primary key could not be translated (not RSA or DSA?)."
else
# output a line for the sub key
# 0 = ok, 1 = bad
if [ "$keyOK" -a "$uidOK" -a "$lastKeyOK" ] ; then
- log error " * acceptable sub key."
+ log verbose " * acceptable sub key."
if [ -z "$sshKey" ] ; then
log error " ! sub key could not be translated (not RSA or DSA?)."
else
host="$1"
userID="ssh://${host}"
- log info "processing: $host"
+ log verbose "processing: $host"
nKeys=0
nKeysOK=0
if [ "$HASH_KNOWN_HOSTS" = 'true' ] ; then
# FIXME: this is really hackish cause ssh-keygen won't
# hash from stdin to stdout
- tmpfile=$(mktemp)
+ tmpfile=$(mktemp ${TMPDIR:-/tmp}/tmp.XXXXXXXXXX)
ssh2known_hosts "$host" "$sshKey" > "$tmpfile"
ssh-keygen -H -f "$tmpfile" 2> /dev/null
cat "$tmpfile" >> "$KNOWN_HOSTS"
nHostsOK=0
nHostsBAD=0
- # set the trap to remove any lockfiles on exit
- trap "lockfile-remove $KNOWN_HOSTS" EXIT
-
- # create a lockfile on known_hosts
- lockfile-create "$KNOWN_HOSTS"
+ # create a lockfile on known_hosts:
+ lock create "$KNOWN_HOSTS"
+ # FIXME: we're discarding any pre-existing EXIT trap; is this bad?
+ trap "lock remove $KNOWN_HOSTS" EXIT
# note pre update file checksum
fileCheck="$(file_hash "$KNOWN_HOSTS")"
esac
# touch the lockfile, for good measure.
- lockfile-touch --oneshot "$KNOWN_HOSTS"
+ lock touch "$KNOWN_HOSTS"
done
- # remove the lockfile
- lockfile-remove "$KNOWN_HOSTS"
+ # remove the lockfile and the trap
+ lock remove "$KNOWN_HOSTS"
+ trap - EXIT
# note if the known_hosts file was updated
if [ "$(file_hash "$KNOWN_HOSTS")" != "$fileCheck" ] ; then
- log info "known_hosts file updated."
+ log verbose "known_hosts file updated."
fi
# if an acceptable host was found, return 0
process_known_hosts() {
local hosts
- log info "processing known_hosts file..."
+ log verbose "processing known_hosts file..."
hosts=$(meat "$KNOWN_HOSTS" | cut -d ' ' -f 1 | grep -v '^|.*$' | tr , ' ' | tr '\n' ' ')
userID="$1"
- log info "processing: $userID"
+ log verbose "processing: $userID"
nKeys=0
nKeysOK=0
nIDsOK=0
nIDsBAD=0
- # set the trap to remove any lockfiles on exit
- trap "lockfile-remove $AUTHORIZED_KEYS" EXIT
-
# create a lockfile on authorized_keys
- lockfile-create "$AUTHORIZED_KEYS"
+ lock create "$AUTHORIZED_KEYS"
+ # FIXME: we're discarding any pre-existing EXIT trap; is this bad?
+ trap "lock remove $AUTHORIZED_KEYS" EXIT
# note pre update file checksum
fileCheck="$(file_hash "$AUTHORIZED_KEYS")"
esac
# touch the lockfile, for good measure.
- lockfile-touch --oneshot "$AUTHORIZED_KEYS"
+ lock touch "$AUTHORIZED_KEYS"
done
- # remove the lockfile
- lockfile-remove "$AUTHORIZED_KEYS"
+ # remove the lockfile and the trap
+ lock remove "$AUTHORIZED_KEYS"
+ trap - EXIT
# note if the authorized_keys file was updated
if [ "$(file_hash "$AUTHORIZED_KEYS")" != "$fileCheck" ] ; then
- log info "authorized_keys file updated."
+ log verbose "authorized_keys file updated."
fi
# if an acceptable id was found, return 0
authorizedUserIDs="$1"
- log info "processing authorized_user_ids file..."
+ log verbose "processing authorized_user_ids file..."
if ! meat "$authorizedUserIDs" > /dev/null ; then
log error "no user IDs to process."
projects / monkeysphere.git / blobdiff