1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-08 07:52:40 +01:00

Add an optional "--sshd-key" argument to "bin/ssh-auth" for reading "%k" from modern sshd

Summary: Depends on D20873. Ref T13436. Allow callers to configure "bin/ssh-auth --sshd-key %k" as an "AuthorizedKeysCommand"; if they do, and we recognize the key, emit just that key in the output.

Test Plan:
  - Used `git pull` locally, still worked fine.
  - Instrumented things, saw the public key lookup actually work and emit a single key.
  - Ran without "--sshd-key", got a full key list as before.

Maniphest Tasks: T13436

Differential Revision: https://secure.phabricator.com/D20874
This commit is contained in:
epriestley 2019-09-13 08:25:22 -07:00
parent 02f85f03bd
commit 24f771c1bc

View file

@ -4,6 +4,24 @@
$root = dirname(dirname(dirname(__FILE__)));
require_once $root.'/scripts/init/init-script.php';
// TODO: For now, this is using "parseParital()", not "parse()". This allows
// the script to accept (and ignore) additional arguments. This preserves
// backward compatibility until installs have time to migrate to the new
// syntax.
$args = id(new PhutilArgumentParser($argv))
->parsePartial(
array(
array(
'name' => 'sshd-key',
'param' => 'k',
'help' => pht(
'Accepts the "%%k" parameter from "AuthorizedKeysCommand".'),
),
));
$sshd_key = $args->getArg('sshd-key');
// NOTE: We are caching a datastructure rather than the flat key file because
// the path on disk to "ssh-exec" is arbitrarily mutable at runtime. See T12397.
@ -85,6 +103,22 @@ if ($authstruct === null) {
$cache->setKey($authstruct_key, $authstruct_raw, $ttl);
}
// If we've received an "--sshd-key" argument and it matches some known key,
// only emit that key. (For now, if the key doesn't match, we'll fall back to
// emitting all keys.)
if ($sshd_key !== null) {
$matches = array();
foreach ($authstruct['keys'] as $key => $key_struct) {
if (phutil_hashes_are_identical($key_struct['key'], $sshd_key)) {
$matches[$key] = $key_struct;
}
}
if ($matches) {
$authstruct['keys'] = $matches;
}
}
$bin = $root.'/bin/ssh-exec';
$instance = PhabricatorEnv::getEnvConfig('cluster.instance');