mirror of
https://github.com/go-gitea/gitea
synced 2024-11-25 16:42:48 +01:00
80 lines
2.3 KiB
Go
80 lines
2.3 KiB
Go
|
// Copyright 2024 The Gitea Authors. All rights reserved.
|
||
|
|
// SPDX-License-Identifier: MIT
|
||
|
|
|
||
|
|
package asymkey
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"fmt"
|
||
|
|
"os"
|
||
|
|
"path/filepath"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
asymkey_model "code.gitea.io/gitea/models/asymkey"
|
||
|
|
"code.gitea.io/gitea/modules/log"
|
||
|
|
"code.gitea.io/gitea/modules/setting"
|
||
|
|
"code.gitea.io/gitea/modules/util"
|
||
|
|
)
|
||
|
|
|
||
|
|
// RewriteAllPublicKeys removes any authorized key and rewrite all keys from database again.
|
||
|
|
// Note: db.GetEngine(ctx).Iterate does not get latest data after insert/delete, so we have to call this function
|
||
|
|
// outside any session scope independently.
|
||
|
|
func RewriteAllPublicKeys(ctx context.Context) error {
|
||
|
|
// Don't rewrite key if internal server
|
||
|
|
if setting.SSH.StartBuiltinServer || !setting.SSH.CreateAuthorizedKeysFile {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
return asymkey_model.WithSSHOpLocker(func() error {
|
||
|
|
return rewriteAllPublicKeys(ctx)
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
func rewriteAllPublicKeys(ctx context.Context) error {
|
||
|
|
if setting.SSH.RootPath != "" {
|
||
|
|
// First of ensure that the RootPath is present, and if not make it with 0700 permissions
|
||
|
|
// This of course doesn't guarantee that this is the right directory for authorized_keys
|
||
|
|
// but at least if it's supposed to be this directory and it doesn't exist and we're the
|
||
|
|
// right user it will at least be created properly.
|
||
|
|
err := os.MkdirAll(setting.SSH.RootPath, 0o700)
|
||
|
|
if err != nil {
|
||
|
|
log.Error("Unable to MkdirAll(%s): %v", setting.SSH.RootPath, err)
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
fPath := filepath.Join(setting.SSH.RootPath, "authorized_keys")
|
||
|
|
tmpPath := fPath + ".tmp"
|
||
|
|
t, err := os.OpenFile(tmpPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600)
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
defer func() {
|
||
|
|
t.Close()
|
||
|
|
if err := util.Remove(tmpPath); err != nil {
|
||
|
|
log.Warn("Unable to remove temporary authorized keys file: %s: Error: %v", tmpPath, err)
|
||
|
|
}
|
||
|
|
}()
|
||
|
|
|
||
|
|
if setting.SSH.AuthorizedKeysBackup {
|
||
|
|
isExist, err := util.IsExist(fPath)
|
||
|
|
if err != nil {
|
||
|
|
log.Error("Unable to check if %s exists. Error: %v", fPath, err)
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if isExist {
|
||
|
|
bakPath := fmt.Sprintf("%s_%d.gitea_bak", fPath, time.Now().Unix())
|
||
|
|
if err = util.CopyFile(fPath, bakPath); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if err := asymkey_model.RegeneratePublicKeys(ctx, t); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
|
||
|
|
t.Close()
|
||
|
|
return util.Rename(tmpPath, fPath)
|
||
|
|
}
|