summaryrefslogtreecommitdiff
path: root/src/share/m
diff options
context:
space:
mode:
authorJameson Graef Rollins <jrollins@finestructure.net>2009-03-18 12:01:02 -0400
committerJameson Graef Rollins <jrollins@finestructure.net>2009-03-18 12:01:02 -0400
commit3f71bfc52f158a76755a7b75362b449439819fa7 (patch)
tree8bcb04c6922935b03768225c68f682a2bfd0bab7 /src/share/m
parenta8c28d0a9090264f0ae357b282156615e39d216d (diff)
modify the ssh_proxycommand marginal ui output so that it better
handles the case where the host can not be contacted. the new system attempts to retrieve the host ssh key before any ui output is made. this should make things a little clearer in this corner case, and make things a little more flexible down the line.
Diffstat (limited to 'src/share/m')
-rw-r--r--src/share/m/ssh_proxycommand137
1 files changed, 74 insertions, 63 deletions
diff --git a/src/share/m/ssh_proxycommand b/src/share/m/ssh_proxycommand
index 7ab4bec..2078445 100644
--- a/src/share/m/ssh_proxycommand
+++ b/src/share/m/ssh_proxycommand
@@ -36,52 +36,55 @@ output_no_valid_key() {
LOG_PREFIX=
- cat <<EOF | log info
--------------------- Monkeysphere warning -------------------
-Monkeysphere found OpenPGP keys for this hostname, but none had full validity.
-EOF
-
- # retrieve the actual ssh key
- sshKeyOffered=$(ssh-keyscan -t rsa -p "$PORT" "$HOST" 2>/dev/null | awk '{ print $2, $3 }')
- # FIXME: should we do any checks for failed keyscans, eg. host not
- # found?
+ # retrieve the ssh key being offered by the host
+ sshKeyOffered=$(ssh-keyscan -t rsa -p "$PORT" "$HOST" 2>/dev/null \
+ | awk '{ print $2, $3 }')
# get the gpg info for userid
gpgOut=$(gpg_user --list-key --fixed-list-mode --with-colon \
--with-fingerprint --with-fingerprint \
="$userID" 2>/dev/null)
- # find all 'pub' and 'sub' lines in the gpg output, which each
- # represent a retrieved key for the user ID
- echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \
- while IFS=: read -r type validity keyid uidfpr usage ; do
- case $type in
- 'pub'|'sub')
- # get the ssh key of the gpg key
- sshKeyGPG=$(gpg2ssh "$keyid")
-
- # if one of keys found matches the one offered by the
- # host, then output info
- if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then
- cat <<EOF | log info
+ # output header
+ cat <<EOF | log info
+-------------------- Monkeysphere warning -------------------
+Monkeysphere found OpenPGP keys for this hostname, but none had full validity.
+EOF
+
+ # if the host key is retrieved from the host, check against known
+ # OpenPGP keys
+ if [ "$sshKeyOffered" ] ; then
+ # find all 'pub' and 'sub' lines in the gpg output, which each
+ # represent a retrieved key for the user ID
+ echo "$gpgOut" | cut -d: -f1,2,5,10,12 | \
+ while IFS=: read -r type validity keyid uidfpr usage ; do
+ case $type in
+ 'pub'|'sub')
+ # get the ssh key of the gpg key
+ sshKeyGPG=$(gpg2ssh "$keyid")
+
+ # if one of keys found matches the one offered by the
+ # host, then output info
+ if [ "$sshKeyGPG" = "$sshKeyOffered" ] ; then
+ cat <<EOF | log info
An OpenPGP key matching the ssh key offered by the host was found:
EOF
- sshKeyGPGFile=$(msmktempfile)
- printf "%s" "$sshKeyGPG" >"$sshKeyGPGFile"
- sshFingerprint=$(ssh-keygen -l -f "$sshKeyGPGFile" | \
- awk '{ print $2 }')
- rm -f "$sshKeyGPGFile"
+ sshKeyGPGFile=$(msmktempfile)
+ printf "%s" "$sshKeyGPG" >"$sshKeyGPGFile"
+ sshFingerprint=$(ssh-keygen -l -f "$sshKeyGPGFile" | \
+ awk '{ print $2 }')
+ rm -f "$sshKeyGPGFile"
- # get the sigs for the matching key
- gpgSigOut=$(gpg_user --check-sigs \
- --list-options show-uid-validity \
- "$keyid")
+ # get the sigs for the matching key
+ gpgSigOut=$(gpg_user --check-sigs \
+ --list-options show-uid-validity \
+ "$keyid")
- # output the sigs, but only those on the user ID
- # we are looking for
- echo "$gpgSigOut" | awk '
+ # output the sigs, but only those on the user ID
+ # we are looking for
+ echo "$gpgSigOut" | awk '
{
if (match($0,"^pub")) { print; }
if (match($0,"^uid")) { ok=0; }
@@ -89,50 +92,58 @@ if (match($0,"^uid.*'$userID'$")) { ok=1; print; }
if (ok) { if (match($0,"^sig")) { print; } }
}
' | log info
- echo | log info
+ echo | log info
- # output the other user IDs for reference
- if (echo "$gpgSigOut" | grep "^uid" | grep -v -q "$userID") ; then
- cat <<EOF | log info
+ # output the other user IDs for reference
+ if (echo "$gpgSigOut" | grep "^uid" | grep -v -q "$userID") ; then
+ cat <<EOF | log info
Other user IDs on this key:
EOF
- echo "$gpgSigOut" | grep "^uid" | grep -v "$userID" | log info
- echo | log info
- fi
+ echo "$gpgSigOut" | grep "^uid" | grep -v "$userID" | log info
+ echo | log info
+ fi
- # output ssh fingerprint
- cat <<EOF | log info
+ # output ssh fingerprint
+ cat <<EOF | log info
RSA key fingerprint is ${sshFingerprint}.
EOF
- # this whole process is in a "while read"
- # subshell. the only way to get information out
- # of the subshell is to change the return code.
- # therefore we return 1 here to indicate that a
- # matching gpg key was found for the ssh key
- # offered by the host
- return 1
- fi
- ;;
- esac
- done || returnCode="$?"
-
- # if no key match was made (and the "while read" subshell returned
- # 1) output how many keys were found
- if (( returnCode != 1 )) ; then
- cat <<EOF | log info
+ # this whole process is in a "while read"
+ # subshell. the only way to get information
+ # out of the subshell is to change the return
+ # code. therefore we return 1 here to
+ # indicate that a matching gpg key was found
+ # for the ssh key offered by the host
+ return 1
+ fi
+ ;;
+ esac
+ done || returnCode="$?"
+
+ # if no key match was made (and the "while read" subshell
+ # returned 1) output how many keys were found
+ if (( returnCode != 1 )) ; then
+ cat <<EOF | log info
None of the found keys matched the key offered by the host.
Run the following command for more info about the found keys:
gpg --check-sigs --list-options show-uid-validity =${userID}
EOF
- # FIXME: should we do anything extra here if the retrieved
- # host key is actually in the known_hosts file and the ssh
- # connection will succeed? Should the user be warned?
- # prompted?
+ # FIXME: should we do anything extra here if the retrieved
+ # host key is actually in the known_hosts file and the ssh
+ # connection will succeed? Should the user be warned?
+ # prompted?
+ fi
+
+ # if host key could not be retrieved from the host, output message
+ else
+ cat <<EOF | log info
+Could not retrieve RSA host key from $HOST.
+EOF
fi
+ # output footer
cat <<EOF | log info
-------------------- ssh continues below --------------------
EOF