Merge commit 'jrollins/master'

[monkeysphere.git] / src / share / m / ssh_proxycommand

diff --git a/src/share/m/ssh_proxycommand b/src/share/m/ssh_proxycommand
index cd0a1fb14436b833055e2c6ab3bc736a1534abbf..7ab4bec1331e265eb5b7185cc7eac0b6b753b871 100644 (file)
--- a/src/share/m/ssh_proxycommand
+++ b/src/share/m/ssh_proxycommand
@@ -15,13 +15,12 @@
 # established.  Can be added to ~/.ssh/config as follows:
 #  ProxyCommand monkeysphere ssh-proxycommand %h %p
 
-ssh_proxycommand() {
-
 # "marginal case" ouput in the case that there is not a full
 # validation path to the host
 output_no_valid_key() {
-    local sshKeyOffered
     local userID
+    local sshKeyOffered
+    local gpgOut
     local type
     local validity
     local keyid
@@ -31,9 +30,12 @@ output_no_valid_key() {
     local tmpkey
     local sshFingerprint
     local gpgSigOut
+    local returnCode=0
 
     userID="ssh://${HOSTP}"
 
+    LOG_PREFIX=
+
     cat <<EOF | log info
 -------------------- Monkeysphere warning -------------------
 Monkeysphere found OpenPGP keys for this hostname, but none had full validity.
@@ -45,7 +47,7 @@ EOF
     # found?
 
     # get the gpg info for userid
-    gpgOut=$(gpg --list-key --fixed-list-mode --with-colon \
+    gpgOut=$(gpg_user --list-key --fixed-list-mode --with-colon \
        --with-fingerprint --with-fingerprint \
        ="$userID" 2>/dev/null)
 
@@ -66,14 +68,14 @@ An OpenPGP key matching the ssh key offered by the host was found:
 
 EOF
 
-                   # do some crazy "Here Strings" redirection to get the key to
-                   # ssh-keygen, since it doesn't read from stdin cleanly
-                   sshFingerprint=$(ssh-keygen -l -f /dev/stdin \
-                       <<<$(echo "$sshKeyGPG") | \
+                   sshKeyGPGFile=$(msmktempfile)
+                   printf "%s" "$sshKeyGPG" >"$sshKeyGPGFile"
+                   sshFingerprint=$(ssh-keygen -l -f "$sshKeyGPGFile" | \
                        awk '{ print $2 }')
+                   rm -f "$sshKeyGPGFile"
 
                    # get the sigs for the matching key
-                   gpgSigOut=$(gpg --check-sigs \
+                   gpgSigOut=$(gpg_user --check-sigs \
                        --list-options show-uid-validity \
                        "$keyid")
 
@@ -114,11 +116,11 @@ EOF
                fi
                ;;
        esac
-    done
+    done || returnCode="$?"
 
     # if no key match was made (and the "while read" subshell returned
     # 1) output how many keys were found
-    if (($? != 1)) ; then
+    if (( returnCode != 1 )) ; then
        cat <<EOF | log info
 None of the found keys matched the key offered by the host.
 Run the following command for more info about the found keys:
@@ -136,10 +138,9 @@ EOF
 EOF
 }
 
-########################################################################
 
-# export the monkeysphere log level
-export MONKEYSPHERE_LOG_LEVEL
+# the ssh proxycommand function itself
+ssh_proxycommand() {
 
 if [ "$1" = '--no-connect' ] ; then
     NO_CONNECT='true'
@@ -170,12 +171,13 @@ URI="ssh://${HOSTP}"
 # intentionally different than that of running monkeyesphere normally,
 # and keyserver checking is intentionally done under certain
 # circumstances.  This can be overridden by setting the
-# MONKEYSPHERE_CHECK_KEYSERVER environment variable.
+# MONKEYSPHERE_CHECK_KEYSERVER environment variable, or by setting the
+# CHECK_KEYSERVER variable in the monkeysphere.conf file.
 
 # if the host is in the gpg keyring...
-if gpg --list-key ="${URI}" 2>&1 >/dev/null ; then
+if gpg_user --list-key ="${URI}" 2>&1 >/dev/null ; then
     # do not check the keyserver
-    CHECK_KEYSERVER="false"
+    CHECK_KEYSERVER=${CHECK_KEYSERVER:="false"}
 
 # if the host is NOT in the keyring...
 else
@@ -188,25 +190,27 @@ else
        # FIXME: more nuanced checking should be done here to properly
        # take into consideration hosts that join monkeysphere by
        # converting an existing and known ssh key
-       CHECK_KEYSERVER="false"
+       CHECK_KEYSERVER=${CHECK_KEYSERVER:="false"}
 
     # if the host key is not found in the known_hosts file...
     else
        # check the keyserver
-       CHECK_KEYSERVER="true"
+       CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"}
     fi
 fi
-# set and export the variable for use by monkeysphere
-MONKEYSPHERE_CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="$CHECK_KEYSERVER"}
-export MONKEYSPHERE_CHECK_KEYSERVER
+
+# finally look in the MONKEYSPHERE_ environment variable for a
+# CHECK_KEYSERVER setting to override all else
+CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=$CHECK_KEYSERVER}
 
 # update the known_hosts file for the host
-monkeysphere update-known_hosts "$HOSTP"
+local returnCode=0
+update_known_hosts "$HOSTP" || returnCode="$?"
 
 # output on depending on the return of the update-known_hosts
 # subcommand, which is (ultimately) the return code of the
 # update_known_hosts function in common
-case $? in
+case "$returnCode" in
     0)
        # acceptable host key found so continue to ssh
        true