mirror of
https://we.phorge.it/source/phorge.git
synced 2024-12-23 14:00:56 +01:00
8840f60218
Summary: Ref T2230. This is substantially more complicated than Git, but mostly because Mercurial's protocol is a like 50 ad-hoc extensions cobbled together. Because we must decode protocol frames in order to determine if a request is read or write, 90% of this is implementing a stream parser for the protocol. Mercurial's own parser is simpler, but relies on blocking reads. Since we don't even have methods for blocking reads right now and keeping the whole thing non-blocking is conceptually better, I made the parser nonblocking. It ends up being a lot of stuff. I made an effort to cover it reasonably well with unit tests, and to make sure we fail closed (i.e., reject requests) if there are any parts of the protocol I got wrong. A lot of the complexity is sharable with the HTTP stuff, so it ends up being not-so-bad, just very hard to verify by inspection as clearly correct. Test Plan: - Ran `hg clone` over SSH. - Ran `hg fetch` over SSH. - Ran `hg push` over SSH, to a read-only repo (error) and a read-write repo (success). Reviewers: btrahan, asherkin Reviewed By: btrahan CC: aran Maniphest Tasks: T2230 Differential Revision: https://secure.phabricator.com/D7553
107 lines
2.7 KiB
PHP
Executable file
107 lines
2.7 KiB
PHP
Executable file
#!/usr/bin/env php
|
|
<?php
|
|
|
|
$root = dirname(dirname(dirname(__FILE__)));
|
|
require_once $root.'/scripts/__init_script__.php';
|
|
|
|
// First, figure out the authenticated user.
|
|
$args = new PhutilArgumentParser($argv);
|
|
$args->setTagline('receive SSH requests');
|
|
$args->setSynopsis(<<<EOSYNOPSIS
|
|
**ssh-exec** --phabricator-ssh-user __user__ [--ssh-command __commmand__]
|
|
Receive SSH requests.
|
|
EOSYNOPSIS
|
|
);
|
|
|
|
$args->parse(
|
|
array(
|
|
array(
|
|
'name' => 'phabricator-ssh-user',
|
|
'param' => 'username',
|
|
),
|
|
array(
|
|
'name' => 'ssh-command',
|
|
'param' => 'command',
|
|
),
|
|
));
|
|
|
|
try {
|
|
$user_name = $args->getArg('phabricator-ssh-user');
|
|
if (!strlen($user_name)) {
|
|
throw new Exception("No username.");
|
|
}
|
|
|
|
$user = id(new PhabricatorUser())->loadOneWhere(
|
|
'userName = %s',
|
|
$user_name);
|
|
if (!$user) {
|
|
throw new Exception("Invalid username.");
|
|
}
|
|
|
|
if ($user->getIsDisabled()) {
|
|
throw new Exception("You have been exiled.");
|
|
}
|
|
|
|
if ($args->getArg('ssh-command')) {
|
|
$original_command = $args->getArg('ssh-command');
|
|
} else {
|
|
$original_command = getenv('SSH_ORIGINAL_COMMAND');
|
|
}
|
|
|
|
// Now, rebuild the original command.
|
|
$original_argv = id(new PhutilShellLexer())
|
|
->splitArguments($original_command);
|
|
if (!$original_argv) {
|
|
throw new Exception("No interactive logins.");
|
|
}
|
|
$command = head($original_argv);
|
|
array_unshift($original_argv, 'phabricator-ssh-exec');
|
|
|
|
$original_args = new PhutilArgumentParser($original_argv);
|
|
|
|
$workflows = array(
|
|
new ConduitSSHWorkflow(),
|
|
new DiffusionSSHMercurialServeWorkflow(),
|
|
new DiffusionSSHGitUploadPackWorkflow(),
|
|
new DiffusionSSHGitReceivePackWorkflow(),
|
|
);
|
|
|
|
$workflow_names = mpull($workflows, 'getName', 'getName');
|
|
if (empty($workflow_names[$command])) {
|
|
throw new Exception("Invalid command.");
|
|
}
|
|
|
|
$workflow = $original_args->parseWorkflows($workflows);
|
|
$workflow->setUser($user);
|
|
|
|
$sock_stdin = fopen('php://stdin', 'r');
|
|
if (!$sock_stdin) {
|
|
throw new Exception("Unable to open stdin.");
|
|
}
|
|
|
|
$sock_stdout = fopen('php://stdout', 'w');
|
|
if (!$sock_stdout) {
|
|
throw new Exception("Unable to open stdout.");
|
|
}
|
|
|
|
$sock_stderr = fopen('php://stderr', 'w');
|
|
if (!$sock_stderr) {
|
|
throw new Exception("Unable to open stderr.");
|
|
}
|
|
|
|
$socket_channel = new PhutilSocketChannel(
|
|
$sock_stdin,
|
|
$sock_stdout);
|
|
$error_channel = new PhutilSocketChannel(null, $sock_stderr);
|
|
$metrics_channel = new PhutilMetricsChannel($socket_channel);
|
|
$workflow->setIOChannel($metrics_channel);
|
|
$workflow->setErrorChannel($error_channel);
|
|
|
|
$err = $workflow->execute($original_args);
|
|
|
|
$metrics_channel->flush();
|
|
$error_channel->flush();
|
|
} catch (Exception $ex) {
|
|
fwrite(STDERR, "phabricator-ssh-exec: ".$ex->getMessage()."\n");
|
|
exit(1);
|
|
}
|