code.gitea.io/gitea@v1.22.3/services/asymkey/ssh_key_authorized_principals.go (about)

     1  // Copyright 2021 The Gitea Authors. All rights reserved.
     2  // SPDX-License-Identifier: MIT
     3  
     4  package asymkey
     5  
     6  import (
     7  	"bufio"
     8  	"context"
     9  	"fmt"
    10  	"io"
    11  	"os"
    12  	"path/filepath"
    13  	"strings"
    14  	"time"
    15  
    16  	asymkey_model "code.gitea.io/gitea/models/asymkey"
    17  	"code.gitea.io/gitea/models/db"
    18  	"code.gitea.io/gitea/modules/log"
    19  	"code.gitea.io/gitea/modules/setting"
    20  	"code.gitea.io/gitea/modules/util"
    21  )
    22  
    23  // This file contains functions for creating authorized_principals files
    24  //
    25  // There is a dependence on the database within RewriteAllPrincipalKeys & RegeneratePrincipalKeys
    26  // The sshOpLocker is used from ssh_key_authorized_keys.go
    27  
    28  const (
    29  	authorizedPrincipalsFile = "authorized_principals"
    30  	tplCommentPrefix         = `# gitea public key`
    31  )
    32  
    33  // RewriteAllPrincipalKeys removes any authorized principal and rewrite all keys from database again.
    34  // Note: db.GetEngine(ctx).Iterate does not get latest data after insert/delete, so we have to call this function
    35  // outside any session scope independently.
    36  func RewriteAllPrincipalKeys(ctx context.Context) error {
    37  	// Don't rewrite key if internal server
    38  	if setting.SSH.StartBuiltinServer || !setting.SSH.CreateAuthorizedPrincipalsFile {
    39  		return nil
    40  	}
    41  
    42  	return asymkey_model.WithSSHOpLocker(func() error {
    43  		return rewriteAllPrincipalKeys(ctx)
    44  	})
    45  }
    46  
    47  func rewriteAllPrincipalKeys(ctx context.Context) error {
    48  	if setting.SSH.RootPath != "" {
    49  		// First of ensure that the RootPath is present, and if not make it with 0700 permissions
    50  		// This of course doesn't guarantee that this is the right directory for authorized_keys
    51  		// but at least if it's supposed to be this directory and it doesn't exist and we're the
    52  		// right user it will at least be created properly.
    53  		err := os.MkdirAll(setting.SSH.RootPath, 0o700)
    54  		if err != nil {
    55  			log.Error("Unable to MkdirAll(%s): %v", setting.SSH.RootPath, err)
    56  			return err
    57  		}
    58  	}
    59  
    60  	fPath := filepath.Join(setting.SSH.RootPath, authorizedPrincipalsFile)
    61  	tmpPath := fPath + ".tmp"
    62  	t, err := os.OpenFile(tmpPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600)
    63  	if err != nil {
    64  		return err
    65  	}
    66  	defer func() {
    67  		t.Close()
    68  		os.Remove(tmpPath)
    69  	}()
    70  
    71  	if setting.SSH.AuthorizedPrincipalsBackup {
    72  		isExist, err := util.IsExist(fPath)
    73  		if err != nil {
    74  			log.Error("Unable to check if %s exists. Error: %v", fPath, err)
    75  			return err
    76  		}
    77  		if isExist {
    78  			bakPath := fmt.Sprintf("%s_%d.gitea_bak", fPath, time.Now().Unix())
    79  			if err = util.CopyFile(fPath, bakPath); err != nil {
    80  				return err
    81  			}
    82  		}
    83  	}
    84  
    85  	if err := regeneratePrincipalKeys(ctx, t); err != nil {
    86  		return err
    87  	}
    88  
    89  	t.Close()
    90  	return util.Rename(tmpPath, fPath)
    91  }
    92  
    93  func regeneratePrincipalKeys(ctx context.Context, t io.StringWriter) error {
    94  	if err := db.GetEngine(ctx).Where("type = ?", asymkey_model.KeyTypePrincipal).Iterate(new(asymkey_model.PublicKey), func(idx int, bean any) (err error) {
    95  		_, err = t.WriteString((bean.(*asymkey_model.PublicKey)).AuthorizedString())
    96  		return err
    97  	}); err != nil {
    98  		return err
    99  	}
   100  
   101  	fPath := filepath.Join(setting.SSH.RootPath, authorizedPrincipalsFile)
   102  	isExist, err := util.IsExist(fPath)
   103  	if err != nil {
   104  		log.Error("Unable to check if %s exists. Error: %v", fPath, err)
   105  		return err
   106  	}
   107  	if isExist {
   108  		f, err := os.Open(fPath)
   109  		if err != nil {
   110  			return err
   111  		}
   112  		defer f.Close()
   113  
   114  		scanner := bufio.NewScanner(f)
   115  		for scanner.Scan() {
   116  			line := scanner.Text()
   117  			if strings.HasPrefix(line, tplCommentPrefix) {
   118  				scanner.Scan()
   119  				continue
   120  			}
   121  			_, err = t.WriteString(line + "\n")
   122  			if err != nil {
   123  				return err
   124  			}
   125  		}
   126  		if err = scanner.Err(); err != nil {
   127  			return fmt.Errorf("regeneratePrincipalKeys scan: %w", err)
   128  		}
   129  	}
   130  	return nil
   131  }