X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=secnet.git;a=blobdiff_plain;f=make-secnet-sites;h=f9c249bb7ac904dfc610e64bed99ef15fa9a5503;hp=16b124c9df5b9bc7d03e030d4c377d28d387cc02;hb=e8344e4877576df778013d8837780001d0994ef8;hpb=9da1f13b367a9e3cc6f65a16cb319708fd5f4dbf

diff --git a/make-secnet-sites b/make-secnet-sites
index 16b124c..f9c249b 100755
--- a/make-secnet-sites
+++ b/make-secnet-sites
@@ -282,18 +282,116 @@ class PkmInstall(PkmBase):
 	def site_finish(self,confw):
 		self._pw.close()
 		os.rename(self._pa+'~tmp',self._pa+'~update')
+		PkmElide.site_finish(self,confw)
+
+class PkmElide(PkmBase):
+	opt = 'elide'
+	help = 'no public keys in sites.conf output nor in directory'
+	def site_finish(self,confw):
 		confw.write("peer-keys \"%s\";\n"%self._pa);
 
+class OpBase():
+	# Base case is reading a sites file from self.inputfilee.
+	# And writing a sites file to self.sitesfile.
+	def read_in(self):
+		if self.inputfile is None:
+			self.inputlines = pfile("stdin",sys.stdin.readlines())
+		else:
+			self.inputlines = pfilepath(self.inputfile)
+	def write_out(self):
+		if self.sitesfile is None:
+			f=sys.stdout
+		else:
+			f=open(self.sitesfile+"-tmp",'w')
+		f.write("# sites file autogenerated by make-secnet-sites\n")
+		f.write("# generated %s, invoked by %s\n"%
+			(time.asctime(time.localtime(time.time())),
+			 self.user))
+		f.write("# use make-secnet-sites to turn this file into a\n")
+		f.write("# valid /etc/secnet/sites.conf file\n\n")
+		self.write_out_contents(f)
+		f.write("# end of sites file\n")
+		if self.sitesfile is not None:
+			f.close()
+			os.rename(self.sitesfile+"-tmp",self.sitesfile)
+
+class OpConf(OpBase):
+	opts = ['--conf']
+	help = 'sites.conf generation mode (default)'
+	def positional_args(self, av):
+		if len(av.arg)>3:
+			print("Too many arguments")
+			sys.exit(1)
+		(self.inputfile, self.outputfile) = (av.arg + [None]*2)[0:2]
+	def check_group(self,group,w): pass
+	def write_out(self):
+		if self.outputfile is None:
+			of=sys.stdout
+		else:
+			tmp_outputfile=self.outputfile+'~tmp~'
+			of=open(tmp_outputfile,'w')
+		outputsites(of)
+		if self.outputfile is not None:
+			os.rename(tmp_outputfile,self.outputfile)
+
+class OpUserv(OpBase):
+	opts = ['--userv','-u']
+	help = 'userv service fragment update mode'
+	def positional_args(self, av):
+		if len(av.arg)!=4:
+			print("Wrong number of arguments")
+			sys.exit(1)
+		(self.header, self.groupfiledir,
+		 self.sitesfile, self.group) = av.arg
+		self.group = Tainted(self.group,0,'command line')
+		# untrusted argument from caller
+		if "USERV_USER" not in os.environ:
+			print("Environment variable USERV_USER not found")
+			sys.exit(1)
+		self.user=os.environ["USERV_USER"]
+		# Check that group is in USERV_GROUP
+		if "USERV_GROUP" not in os.environ:
+			print("Environment variable USERV_GROUP not found")
+			sys.exit(1)
+		ugs=os.environ["USERV_GROUP"]
+		ok=0
+		for i in ugs.split():
+			if self.group==i: ok=1
+		if not ok:
+			print("caller not in group %s"%group)
+			sys.exit(1)
+	def check_group(self,group,w):
+		if group!=self.group: complain("Incorrect group!")
+		w[2].groupname()
+	def read_in(self):
+		self.headerinput=pfilepath(self.header,allow_include=True)
+		self.userinput=sys.stdin.readlines()
+		pfile("user input",self.userinput)
+	def write_out(self):
+		# Put the user's input into their group file, and
+		# rebuild the main sites file
+		f=open(self.groupfiledir+"/T"+self.group.groupname(),'w')
+		f.write("# Section submitted by user %s, %s\n"%
+			(self.user,time.asctime(time.localtime(time.time()))))
+		f.write("# Checked by make-secnet-sites version %s\n\n"
+			%VERSION)
+		for i in self.userinput: f.write(i)
+		f.write("\n")
+		f.close()
+		os.rename(self.groupfiledir+"/T"+self.group.groupname(),
+			  self.groupfiledir+"/R"+self.group.groupname())
+		OpBase.write_out(self)
+	def write_out_contents(self,f):
+		for i in self.headerinput: f.write(i)
+		files=os.listdir(self.groupfiledir)
+		for i in files:
+			if i[0]=='R':
+				j=open(self.groupfiledir+"/"+i)
+				f.write(j.read())
+				j.close()
+
 def parse_args():
-	global service
-	global inputfile
-	global header
-	global groupfiledir
-	global sitesfile
-	global outputfile
-	global group
-	global user
-	global of
+	global opmode
 	global prefix
 	global key_prefix
 	global debug_level
@@ -302,8 +400,13 @@ def parse_args():
 	global pubkeys_mode
 
 	ap = argparse.ArgumentParser(description='process secnet sites files')
-	ap.add_argument('--userv', '-u', action='store_true',
-			help='userv service fragment update mode')
+	def add_opmode(how):
+		ap.add_argument(*how().opts, action=ArgActionLambda,
+			nargs=0,
+			fn=(lambda v,ns,*x: setattr(ns,'opmode',how)),
+			help=how().help)
+	add_opmode(OpConf)
+	add_opmode(OpUserv)
 	ap.add_argument('--conf-key-prefix', action=ActionNoYes,
 			default=True,
 		 help='prefix conf file key names derived from sites data')
@@ -314,6 +417,7 @@ def parse_args():
 			help=how().help)
 	add_pkm(PkmInstall)
 	add_pkm(PkmSingle)
+	add_pkm(PkmElide)
 	ap.add_argument('--pubkeys-dir',  nargs=1,
 			help='public key directory',
 			default=['/var/lib/secnet/pubkeys'])
@@ -327,39 +431,13 @@ def parse_args():
 	av = ap.parse_args()
 	debug_level = av.debug
 	debugrepr('av',av)
-	service = 1 if av.userv else 0
+	opmode = getattr(av,'opmode',OpConf)()
 	prefix = '' if av.prefix is None else av.prefix[0]
 	key_prefix = av.conf_key_prefix
 	output_version = av.output_version[0]
 	pubkeys_dir = av.pubkeys_dir[0]
 	pubkeys_mode = getattr(av,'pkm',PkmSingle)
-	if service:
-		if len(av.arg)!=4:
-			print("Wrong number of arguments")
-			sys.exit(1)
-		(header, groupfiledir, sitesfile, group) = av.arg
-		group = Tainted(group,0,'command line')
-		# untrusted argument from caller
-		if "USERV_USER" not in os.environ:
-			print("Environment variable USERV_USER not found")
-			sys.exit(1)
-		user=os.environ["USERV_USER"]
-		# Check that group is in USERV_GROUP
-		if "USERV_GROUP" not in os.environ:
-			print("Environment variable USERV_GROUP not found")
-			sys.exit(1)
-		ugs=os.environ["USERV_GROUP"]
-		ok=0
-		for i in ugs.split():
-			if group==i: ok=1
-		if not ok:
-			print("caller not in group %s"%group)
-			sys.exit(1)
-	else:
-		if len(av.arg)>3:
-			print("Too many arguments")
-			sys.exit(1)
-		(inputfile, outputfile) = (av.arg + [None]*2)[0:2]
+	opmode.positional_args(av)
 
 parse_args()
 
@@ -490,7 +568,7 @@ class pubkey (inpub):
 		return len(self.forpub(version,fs)) != 0
 
 class rsakey (pubkey):
-	"An RSA public key"
+	"An old-style RSA public key"
 	def __init__(self,w):
 		self.l=w[1].number(0,max['rsa_bits'],'rsa len')
 		self.e=w[2].bignum_10('rsa','rsa e')
@@ -576,7 +654,7 @@ keywords={
  'pkg':(listof(somepubkey),"start of public key group",'pub'),
  'pkgf':(listof(somepubkey),"start of fallback public key group",'pub'),
  'pub':(listof(somepubkey),"new style public site key"),
- 'pubkey':(listof(somepubkey),"RSA public site key",'pub'),
+ 'pubkey':(listof(somepubkey),"Old-style RSA public site key",'pub'),
  'peer':(single_ipaddr,"Tunnel peer IP address"),
  'address':(address,"External contact address and port"),
  'mobile':(boolean,"Site is mobile"),
@@ -835,10 +913,8 @@ def pline(il,filterstate,allow_include=False):
 		if tname in current.children:
 			# Not new
 			current=current.children[tname]
-			if service and group and current.depth==2:
-				if group!=current.group:
-					complain("Incorrect group!")
-				w[2].groupname()
+			if current.depth==2:
+				opmode.check_group(current.group, w)
 		else:
 			# New
 			# Ignore depth check for now
@@ -961,15 +1037,7 @@ def checkconstraints(n,p,ra):
 	for i in n.children.keys():
 		checkconstraints(n.children[i],new_p,new_ra)
 
-if service:
-	headerinput=pfilepath(header,allow_include=True)
-	userinput=sys.stdin.readlines()
-	pfile("user input",userinput)
-else:
-	if inputfile is None:
-		pfile("stdin",sys.stdin.readlines())
-	else:
-		pfilepath(inputfile)
+opmode.read_in()
 
 delempty(root)
 checkconstraints(root,{},ipaddrset.complete_set())
@@ -980,40 +1048,4 @@ if complaints>0:
 	sys.exit(1)
 complaints=None # arranges to crash if we complain later
 
-if service:
-	# Put the user's input into their group file, and rebuild the main
-	# sites file
-	f=open(groupfiledir+"/T"+group.groupname(),'w')
-	f.write("# Section submitted by user %s, %s\n"%
-		(user,time.asctime(time.localtime(time.time()))))
-	f.write("# Checked by make-secnet-sites version %s\n\n"%VERSION)
-	for i in userinput: f.write(i)
-	f.write("\n")
-	f.close()
-	os.rename(groupfiledir+"/T"+group.groupname(),
-		  groupfiledir+"/R"+group.groupname())
-	f=open(sitesfile+"-tmp",'w')
-	f.write("# sites file autogenerated by make-secnet-sites\n")
-	f.write("# generated %s, invoked by %s\n"%
-		(time.asctime(time.localtime(time.time())),user))
-	f.write("# use make-secnet-sites to turn this file into a\n")
-	f.write("# valid /etc/secnet/sites.conf file\n\n")
-	for i in headerinput: f.write(i)
-	files=os.listdir(groupfiledir)
-	for i in files:
-		if i[0]=='R':
-			j=open(groupfiledir+"/"+i)
-			f.write(j.read())
-			j.close()
-	f.write("# end of sites file\n")
-	f.close()
-	os.rename(sitesfile+"-tmp",sitesfile)
-else:
-	if outputfile is None:
-		of=sys.stdout
-	else:
-		tmp_outputfile=outputfile+'~tmp~'
-		of=open(tmp_outputfile,'w')
-	outputsites(of)
-	if outputfile is not None:
-		os.rename(tmp_outputfile,outputfile)
+opmode.write_out()