X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fcommon;h=8d8e5063258910ebb75f7fe032ff3a438648cc84;hb=b13286dc0e549347f86b64049d4eb2bd2891e1ab;hp=0f98923805600d7d916aa3a1dc352193e627c6dd;hpb=0c2c01095b4e3e707a08e9ff6ebe61f18689bcaa;p=monkeysphere.git

diff --git a/src/common b/src/common
index 0f98923..8d8e506 100644
--- a/src/common
+++ b/src/common
@@ -1,13 +1,13 @@
 # -*-shell-script-*-
 
-# Shared bash functions for the monkeysphere
+# Shared sh functions for the monkeysphere
 #
 # Written by
 # Jameson Rollins <jrollins@fifthhorseman.net>
 #
 # Copyright 2008, released under the GPL, version 3 or later
 
-# all caps variables are meant to be user supplied (ie. from config
+# all-caps variables are meant to be user supplied (ie. from config
 # file) and are considered global
 
 ########################################################################
@@ -42,7 +42,7 @@ cutline() {
 # retrieve all keys with given user id from keyserver
 # FIXME: need to figure out how to retrieve all matching keys
 # (not just first 5)
-gpg_fetch_keys() {
+gpg_fetch_userid() {
     local id
     id="$1"
     echo 1,2,3,4,5 | \
@@ -69,6 +69,18 @@ check_capability() {
     return 0
 }
 
+# get the full fingerprint of a key ID
+get_key_fingerprint() {
+    local keyID
+
+    keyID="$1"
+
+    gpg --list-key --with-colons --fixed-list-mode \
+	--with-fingerprint "$keyID" | grep "$keyID" | \
+	grep '^fpr:' | cut -d: -f10
+}
+
+
 # convert escaped characters from gpg output back into original
 # character
 # FIXME: undo all escape character translation in with-colons gpg output
@@ -111,13 +123,14 @@ gpg2authorized_keys() {
 # userid and key policy checking
 # the following checks policy on the returned keys
 # - checks that full key has appropriate valididy (u|f)
-# - checks key has specified capability (REQUIRED_KEY_CAPABILITY)
+# - checks key has specified capability (REQUIRED_*_KEY_CAPABILITY)
 # - checks that particular desired user id has appropriate validity
 # see /usr/share/doc/gnupg/DETAILS.gz
 # expects global variable: "MODE"
 process_user_id() {
     local userID
     local cacheDir
+    local requiredCapability
     local requiredPubCapability
     local gpgOut
     local line
@@ -136,10 +149,16 @@ process_user_id() {
     userID="$1"
     cacheDir="$2"
 
-    requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]")
+    # set the required key capability based on the mode
+    if [ "$MODE" = 'known_hosts' ] ; then
+	requiredCapability="$REQUIRED_HOST_KEY_CAPABILITY"
+    elif [ "$MODE" = 'authorized_keys' ] ; then
+	requiredCapability="$REQUIRED_USER_KEY_CAPABILITY"	
+    fi
+    requiredPubCapability=$(echo "$requiredCapability" | tr "[:lower:]" "[:upper:]")
 
     # fetch keys from keyserver, return 1 if none found
-    gpg_fetch_keys "$userID" || return 1
+    gpg_fetch_userid "$userID" || return 1
 
     # output gpg info for (exact) userid and store
     gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \
@@ -195,7 +214,7 @@ process_user_id() {
 		keyOK=true
 
 		# add primary key ID to key list if it has required capability
-		if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then
+		if check_capability "$capability" $requiredCapability ; then
 		    keyIDs[${#keyIDs[*]}]="$keyid"
 		fi
 		;;
@@ -218,7 +237,7 @@ process_user_id() {
 		;;
 	    'sub') # sub keys
 		# add sub key ID to key list if it has required capability
-		if check_capability "$capability" $REQUIRED_KEY_CAPABILITY ; then
+		if check_capability "$capability" $requiredCapability ; then
 		    keyIDs[${#keyIDs[*]}]="$keyid"
 		fi
 		;;
@@ -228,6 +247,9 @@ process_user_id() {
     # hash userid for cache file name
     userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }')
 
+    # make sure the cache directory exists
+    mkdir -p "$cacheDir"
+
     # touch/clear key cache file
     # (will be left empty if there are noacceptable keys)
     > "$cacheDir"/"$userIDHash"."$pubKeyID"
@@ -261,21 +283,69 @@ process_user_id() {
     echo "$cacheDir"/"$userIDHash"."$pubKeyID"
 }
 
+# update the cache for userid, and prompt to add file to
+# authorized_user_ids file if the userid is found in gpg
+# and not already in file.
+update_userid() {
+    local userID
+    local cacheDir
+    local keyCache
+
+    userID="$1"
+    cacheDir="$2"
+
+    log "processing userid: '$userID'"
+
+    keyCachePath=$(process_user_id "$userID" "$cacheDir")
+
+    if [ -z "$keyCachePath" ] ; then
+	return 1
+    fi
+    if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+	read -p "user ID not currently authorized.  authorize? [Y|n]: " OK; OK=${OK:=Y}
+	if [ ${OK/y/Y} = 'Y' ] ; then
+	    log -n "adding user ID to authorized_user_ids file... "
+	    echo "$userID" >> "$AUTHORIZED_USER_IDS"
+	    echo "done."
+	else
+	    log "authorized_user_ids file untouched."
+	fi
+    fi
+}
+
+# remove a userid from the authorized_user_ids file
+remove_userid() {
+    local userID
+
+    userID="$1"
+
+    log "processing userid: '$userID'"
+
+    if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+	log "user ID not currently authorized."
+	return 1
+    fi
+
+    log -n "removing user ID '$userID'... "
+    grep -v "$userID" "$AUTHORIZED_USER_IDS" | sponge "$AUTHORIZED_USER_IDS"
+    echo "done."
+}
+
 # process a host for addition to a known_host file
 process_host() {
     local host
     local cacheDir
-    local hostKeyCachePath
+    local keyCachePath
 
     host="$1"
     cacheDir="$2"
 
     log "processing host: '$host'"
 
-    hostKeyCachePath=$(process_user_id "ssh://${host}" "$cacheDir")
+    keyCachePath=$(process_user_id "ssh://${host}" "$cacheDir")
     if [ $? = 0 ] ; then
 	ssh-keygen -R "$host" -f "$USER_KNOWN_HOSTS"
-	cat "$hostKeyCachePath" >> "$USER_KNOWN_HOSTS"
+	cat "$keyCachePath" >> "$USER_KNOWN_HOSTS"
     fi
 }
 
@@ -331,7 +401,8 @@ update_authorized_keys() {
 	cat "$userAuthorizedKeys" >> "$msAuthorizedKeys"
 	echo "done."
     fi
-    log "monkeysphere authorized_keys file generated: $msAuthorizedKeys"
+    log "monkeysphere authorized_keys file generated:"
+    log "$msAuthorizedKeys"
 }
 
 # process an authorized_*_ids file
@@ -361,7 +432,7 @@ process_authorized_ids() {
 # EXPERIMENTAL (unused) process userids found in authorized_keys file
 # go through line-by-line, extract monkeysphere userids from comment
 # fields, and process each userid
-process_userids_from_authorized_keys() {
+process_authorized_keys() {
     local authorizedKeys
     local cacheDir
     local userID
@@ -392,42 +463,43 @@ process_userids_from_authorized_keys() {
     done
 }
 
-# update the cache for userid, and prompt to add file to
-# authorized_user_ids file if the userid is found in gpg
-# and not already in file.
-update_userid() {
-    local userID
-    local cacheDir
-    local userIDKeyCache
-
-    userID="$1"
-    cacheDir="$2"
-
-    log "processing userid: '$userID'"
-    userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
-    if [ -z "$userIDKeyCache" ] ; then
-	return 1
-    fi
-    if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
-	echo "the following userid is not in the authorized_user_ids file:"
-	echo "  $userID"
-	read -p "would you like to add? [Y|n]: " OK; OK=${OK:=Y}
-	if [ ${OK/y/Y} = 'Y' ] ; then
-	    log -n "  adding userid to authorized_user_ids file... "
-	    echo "$userID" >> "$AUTHORIZED_USER_IDS"
-	    echo "done."
-	fi
-    fi
-}
-
 # retrieve key from web of trust, and set owner trust to "full"
 # if key is found.
 trust_key() {
     # get the key from the key server
-    gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'"
+    if ! gpg --keyserver "$KEYSERVER" --recv-key "$keyID" ; then
+	log "could not retrieve key '$keyID'"
+	return 1
+    fi
+
+    # get key fingerprint
+    fingerprint=$(get_key_fingerprint "$keyID")
+
+    # attach a "non-exportable" signature to the key
+    # this is required for the key to have any validity at all
+    # the 'y's on stdin indicates "yes, i really want to sign"
+    echo -e 'y\ny' | gpg --lsign-key --command-fd 0 "$fingerprint"
+
+    # import "full" trust for fingerprint into gpg
+    echo ${fingerprint}:5: | gpg --import-ownertrust
+    if [ $? = 0 ] ; then
+	log "owner trust updated."
+    else
+	failure "there was a problem changing owner trust."
+    fi	
+}
+
+# publish server key to keyserver
+publish_server_key() {
+    read -p "really publish key to $KEYSERVER? [y|N]: " OK; OK=${OK:=N}
+    if [ ${OK/y/Y} != 'Y' ] ; then
+	failure "aborting."
+    fi
 
-    # edit the key to change trust
-    # FIXME: need to figure out how to automate this,
-    # in a batch mode or something.
-    gpg --edit-key "$keyID"
+    # publish host key
+    # FIXME: need to figure out better way to identify host key
+    # dummy command so as not to publish fakes keys during testing
+    # eventually:
+    #gpg --send-keys --keyserver "$KEYSERVER" $(hostname -f)
+    echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $(hostname -f)"
 }