Changeset - b5b91e854308
Parent rev.
Child rev.
[Not reviewed]
default
0 3 0
Thomas De Schampheleire - 6 years ago 2019-07-19 01:12:35
thomas.de_schampheleire@nokia.com
ssh: set a valid locale in the ssh-serve process

In the SSH client configuration, the setting 'SendEnv' could contain variables
like 'LANG', 'LC_ALL', and others. This causes these environment variables
(with their values at the client-side) to be set in the server. However, not
every locale setting valid in the client, is also valid on the server.

This could lead to the error:
'locale.Error: unsupported locale setting'
when 'from mercurial import archival, merge as hg_merge, patch, ui' is
called.

Fix this problem by providing an ini setting 'ssh_locale' that the user can
set correctly, and which will be used to set LC_ALL and LANGUAGE in the
'kallithea-cli ssh-serve' process.

If an environment variable LC_ALL is set, it takes precedence over all other
'LC_xxx' variables, as well as over LANG. So, setting LC_ALL ensures that no
user setting of 'LC_xxx' or 'LANG' could influence ssh-serve badly.

There is one environment variable that might overrule LC_ALL, specifically
for showing messages: 'LANGUAGE'. GNU gettext lets it take precedence over
LC_ALL [1]:
"GNU gettext gives preference to LANGUAGE over LC_ALL and LANG for the
purpose of message handling"

So, also set LANGUAGE to the same value as we set LC_ALL to.


The principle of setting a specific locale in the server process to fix this
error, was first proposed by Dominik Ruf.

[1] https://www.gnu.org/software/gettext/manual/html_node/The-LANGUAGE-variable.html#The-LANGUAGE-variable
3 files changed with 17 insertions and 0 deletions:
development.ini
6
kallithea/bin/kallithea_cli_ssh.py
5
kallithea/lib/paster_commands/template.ini.mako
6
0 comments (0 inline, 0 general)
development.ini
➞
Show inline comments
 
@@ -193,96 +193,102 @@ issue_server_link = https://issues.examp
 

			




	
	
	
		
 
issue_sub =

			




	
	
	
		
 

			




	
	
	
		
 
## issue_pat, issue_server_link and issue_sub can have suffixes to specify

			




	
	
	
		
 
## multiple patterns, to other issues server, wiki or others

			




	
	
	
		
 
## below an example how to create a wiki pattern

			




	
	
	
		
 
# wiki-some-id -> https://wiki.example.com/some-id

			




	
	
	
		
 

			




	
	
	
		
 
#issue_pat_wiki = wiki-(\S+)

			




	
	
	
		
 
#issue_server_link_wiki = https://wiki.example.com/\1

			




	
	
	
		
 
#issue_sub_wiki = WIKI-\1

			




	
	
	
		
 

			




	
	
	
		
 
## alternative return HTTP header for failed authentication. Default HTTP

			




	
	
	
		
 
## response is 401 HTTPUnauthorized. Currently Mercurial clients have trouble with

			




	
	
	
		
 
## handling that. Set this variable to 403 to return HTTPForbidden

			




	
	
	
		
 
auth_ret_code =

			




	
	
	
		
 

			




	
	
	
		
 
## allows to change the repository location in settings page

			




	
	
	
		
 
allow_repo_location_change = True

			




	
	
	
		
 

			




	
	
	
		
 
## allows to setup custom hooks in settings page

			




	
	
	
		
 
allow_custom_hooks_settings = True

			




	
	
	
		
 

			




	
	
	
		
 
## extra extensions for indexing, space separated and without the leading '.'.

			




	
	
	
		
 
# index.extensions =

			




	
	
	
		
 
#    gemfile

			




	
	
	
		
 
#    lock

			




	
	
	
		
 

			




	
	
	
		
 
## extra filenames for indexing, space separated

			




	
	
	
		
 
# index.filenames =

			




	
	
	
		
 
#    .dockerignore

			




	
	
	
		
 
#    .editorconfig

			




	
	
	
		
 
#    INSTALL

			




	
	
	
		
 
#    CHANGELOG

			




	
	
	
		
 

			




	
	
	
		
 
####################################

			




	
	
	
		
 
###           SSH CONFIG        ####

			




	
	
	
		
 
####################################

			




	
	
	
		
 

			




	
	
	
		
 
## SSH is disabled by default, until an Administrator decides to enable it.

			




	
	
	
		
 
ssh_enabled = false

			




	
	
	
		
 

			




	
	
	
		
 
## File where users' SSH keys will be stored *if* ssh_enabled is true.

			




	
	
	
		
 
#ssh_authorized_keys = /home/kallithea/.ssh/authorized_keys

			




	
	
	
		
 

			




	
	
	
		
 
## Path to be used in ssh_authorized_keys file to invoke kallithea-cli with ssh-serve.

			




	
	
	
		
 
#kallithea_cli_path = /srv/kallithea/venv/bin/kallithea-cli

			




	
	
	
		
 

			




	
	
	
		
 
## Locale to be used in the ssh-serve command.

			




	
	
	
		
 
## This is needed because an SSH client may try to use its own locale

			




	
	
	
		
 
## settings, which may not be available on the server.

			




	
	
	
		
 
## See `locale -a` for valid values on this system.

			




	
	
	
		
 
#ssh_locale = C.UTF-8

			




	
	
	
		
 

			




	
	
	
		
 
####################################

			




	
	
	
		
 
###        CELERY CONFIG        ####

			




	
	
	
		
 
####################################

			




	
	
	
		
 

			




	
	
	
		
 
use_celery = false

			




	
	
	
		
 

			




	
	
	
		
 
## Example: connect to the virtual host 'rabbitmqhost' on localhost as rabbitmq:

			




	
	
	
		
 
broker.url = amqp://rabbitmq:qewqew@localhost:5672/rabbitmqhost

			




	
	
	
		
 

			




	
	
	
		
 
celery.imports = kallithea.lib.celerylib.tasks

			




	
	
	
		
 
celery.accept.content = pickle

			




	
	
	
		
 
celery.result.backend = amqp

			




	
	
	
		
 
celery.result.dburi = amqp://

			




	
	
	
		
 
celery.result.serialier = json

			




	
	
	
		
 

			




	
	
	
		
 
#celery.send.task.error.emails = true

			




	
	
	
		
 
#celery.amqp.task.result.expires = 18000

			




	
	
	
		
 

			




	
	
	
		
 
celeryd.concurrency = 2

			




	
	
	
		
 
celeryd.max.tasks.per.child = 1

			




	
	
	
		
 

			




	
	
	
		
 
## If true, tasks will never be sent to the queue, but executed locally instead.

			




	
	
	
		
 
celery.always.eager = false

			




	
	
	
		
 

			




	
	
	
		
 
####################################

			




	
	
	
		
 
###         BEAKER CACHE        ####

			




	
	
	
		
 
####################################

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.data_dir = %(here)s/data/cache/data

			




	
	
	
		
 
beaker.cache.lock_dir = %(here)s/data/cache/lock

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.regions = short_term,long_term,sql_cache_short

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.short_term.type = memory

			




	
	
	
		
 
beaker.cache.short_term.expire = 60

			




	
	
	
		
 
beaker.cache.short_term.key_length = 256

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.long_term.type = memory

			




	
	
	
		
 
beaker.cache.long_term.expire = 36000

			




	
	
	
		
 
beaker.cache.long_term.key_length = 256

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.sql_cache_short.type = memory

			




	
	
	
		
 
beaker.cache.sql_cache_short.expire = 10

			




	
	
	
		
 
beaker.cache.sql_cache_short.key_length = 256

			




	
	
	
		
 

			




	
	
	
		
 
####################################

			




	
	
	
		
 
###       BEAKER SESSION        ####

			




	
	
	
		
 
####################################

			




        

    


    
    

    

        

                

                    kallithea/bin/kallithea_cli_ssh.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
# -*- coding: utf-8 -*-

			




	
	
	
		
 
# This program is free software: you can redistribute it and/or modify

			




	
	
	
		
 
# it under the terms of the GNU General Public License as published by

			




	
	
	
		
 
# the Free Software Foundation, either version 3 of the License, or

			




	
	
	
		
 
# (at your option) any later version.

			




	
	
	
		
 
#

			




	
	
	
		
 
# This program is distributed in the hope that it will be useful,

			




	
	
	
		
 
# but WITHOUT ANY WARRANTY; without even the implied warranty of

			




	
	
	
		
 
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

			




	
	
	
		
 
# GNU General Public License for more details.

			




	
	
	
		
 
#

			




	
	
	
		
 
# You should have received a copy of the GNU General Public License

			




	
	
	
		
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

			




	
	
	
		
 

			




	
	
	
		
 
import click

			




	
	
	
		
 
import kallithea.bin.kallithea_cli_base as cli_base

			




	
	
	
		
 

			




	
	
	
		
 
import os

			




	
	
	
		
 
import sys

			




	
	
	
		
 
import re

			




	
	
	
		
 
import logging

			




	
	
	
		
 
import shlex

			




	
	
	
		
 

			




	
	
	
		
 
import kallithea

			




	
	
	
		
 
from kallithea.lib.utils2 import str2bool

			




	
	
	
		
 
from kallithea.lib.vcs.backends.git.ssh import GitSshHandler

			




	
	
	
		
 
from kallithea.lib.vcs.backends.hg.ssh import MercurialSshHandler

			




	
	
	
		
 
from kallithea.model.ssh_key import SshKeyModel

			




	
	
	
		
 

			




	
	
	
		
 
log = logging.getLogger(__name__)

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
@cli_base.register_command(config_file_initialize_app=True, hidden=True)

			




	
	
	
		
 
@click.argument('user-id', type=click.INT, required=True)

			




	
	
	
		
 
@click.argument('key-id', type=click.INT, required=True)

			




	
	
	
		
 
def ssh_serve(user_id, key_id):

			




	
	
	
		
 
    """Serve SSH repository protocol access.

			




	
	
	
		
 

			




	
	
	
		
 
    The trusted command that is invoked from .ssh/authorized_keys to serve SSH

			




	
	
	
		
 
    protocol access. The access will be granted as the specified user ID, and

			




	
	
	
		
 
    logged as using the specified key ID.

			




	
	
	
		
 
    """

			




	
	
	
		
 
    ssh_enabled = kallithea.CONFIG.get('ssh_enabled', False)

			




	
	
	
		
 
    if not str2bool(ssh_enabled):

			




	
	
	
		
 
        sys.stderr.write("SSH access is disabled.\n")

			




	
	
	
		
 
        return sys.exit(1)

			




	
	
	
		
 

			




	
	
	
		
 
    ssh_locale = kallithea.CONFIG.get('ssh_locale')

			




	
	
	
		
 
    if ssh_locale:

			




	
	
	
		
 
        os.environ['LC_ALL'] = ssh_locale # trumps everything, including LANG, except LANGUAGE

			




	
	
	
		
 
        os.environ['LANGUAGE'] = ssh_locale # trumps LC_ALL for GNU gettext message handling

			




	
	
	
		
 

			




	
	
	
		
 
    ssh_original_command = os.environ.get('SSH_ORIGINAL_COMMAND', '')

			




	
	
	
		
 
    connection = re.search('^([\d\.]+)', os.environ.get('SSH_CONNECTION', ''))

			




	
	
	
		
 
    client_ip = connection.group(1) if connection else '0.0.0.0'

			




	
	
	
		
 
    log.debug('ssh-serve was invoked for SSH command %r from %s', ssh_original_command, client_ip)

			




	
	
	
		
 

			




	
	
	
		
 
    if not ssh_original_command:

			




	
	
	
		
 
        if os.environ.get('SSH_CONNECTION'):

			




	
	
	
		
 
            sys.stderr.write("'kallithea-cli ssh-serve' can only provide protocol access over SSH. Interactive SSH login for this user is disabled.\n")

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            sys.stderr.write("'kallithea-cli ssh-serve' cannot be called directly. It must be specified as command in an SSH authorized_keys file.\n")

			




	
	
	
		
 
        return sys.exit(1)

			




	
	
	
		
 

			




	
	
	
		
 
    try:

			




	
	
	
		
 
        ssh_command_parts = shlex.split(ssh_original_command)

			




	
	
	
		
 
    except ValueError as e:

			




	
	
	
		
 
        sys.stderr.write('Error parsing SSH command %r: %s\n' % (ssh_original_command, e))

			




	
	
	
		
 
        sys.exit(1)

			




	
	
	
		
 
    for VcsHandler in [MercurialSshHandler, GitSshHandler]:

			




	
	
	
		
 
        vcs_handler = VcsHandler.make(ssh_command_parts)

			




	
	
	
		
 
        if vcs_handler is not None:

			




	
	
	
		
 
            vcs_handler.serve(user_id, key_id, client_ip)

			




	
	
	
		
 
            assert False # serve is written so it never will terminate

			




	
	
	
		
 

			




	
	
	
		
 
    sys.stderr.write("This account can only be used for repository access. SSH command %r is not supported.\n" % ssh_original_command)

			




	
	
	
		
 
    sys.exit(1)

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
@cli_base.register_command(config_file_initialize_app=True)

			




	
	
	
		
 
def ssh_update_authorized_keys():

			




	
	
	
		
 
    """Update .ssh/authorized_keys file.

			




	
	
	
		
 

			




	
	
	
		
 
    The file is usually maintained automatically, but this command will also re-write it.

			




	
	
	
		
 
    """

			




	
	
	
		
 

			




	
	
	
		
 
    SshKeyModel().write_authorized_keys()

			




        

    


    
    

    

        

                

                    kallithea/lib/paster_commands/template.ini.mako
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -296,96 +296,102 @@ issue_sub =

			




	
	
	
		
 
# wiki-some-id -> https://wiki.example.com/some-id

			




	
	
	
		
 

			




	
	
	
		
 
#issue_pat_wiki = wiki-(\S+)

			




	
	
	
		
 
#issue_server_link_wiki = https://wiki.example.com/\1

			




	
	
	
		
 
#issue_sub_wiki = WIKI-\1

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## alternative return HTTP header for failed authentication. Default HTTP</%text>

			




	
	
	
		
 
<%text>## response is 401 HTTPUnauthorized. Currently Mercurial clients have trouble with</%text>

			




	
	
	
		
 
<%text>## handling that. Set this variable to 403 to return HTTPForbidden</%text>

			




	
	
	
		
 
auth_ret_code =

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## allows to change the repository location in settings page</%text>

			




	
	
	
		
 
allow_repo_location_change = True

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## allows to setup custom hooks in settings page</%text>

			




	
	
	
		
 
allow_custom_hooks_settings = True

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## extra extensions for indexing, space separated and without the leading '.'.</%text>

			




	
	
	
		
 
# index.extensions =

			




	
	
	
		
 
#    gemfile

			




	
	
	
		
 
#    lock

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## extra filenames for indexing, space separated</%text>

			




	
	
	
		
 
# index.filenames =

			




	
	
	
		
 
#    .dockerignore

			




	
	
	
		
 
#    .editorconfig

			




	
	
	
		
 
#    INSTALL

			




	
	
	
		
 
#    CHANGELOG

			




	
	
	
		
 

			




	
	
	
		
 
<%text>####################################</%text>

			




	
	
	
		
 
<%text>###           SSH CONFIG        ####</%text>

			




	
	
	
		
 
<%text>####################################</%text>

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## SSH is disabled by default, until an Administrator decides to enable it.</%text>

			




	
	
	
		
 
ssh_enabled = false

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## File where users' SSH keys will be stored *if* ssh_enabled is true.</%text>

			




	
	
	
		
 
#ssh_authorized_keys = /home/kallithea/.ssh/authorized_keys

			




	
	
	
		
 
%if user_home_path:

			




	
	
	
		
 
ssh_authorized_keys = ${user_home_path}/.ssh/authorized_keys

			




	
	
	
		
 
%endif

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## Path to be used in ssh_authorized_keys file to invoke kallithea-cli with ssh-serve.</%text>

			




	
	
	
		
 
#kallithea_cli_path = /srv/kallithea/venv/bin/kallithea-cli

			




	
	
	
		
 
%if kallithea_cli_path:

			




	
	
	
		
 
kallithea_cli_path = ${kallithea_cli_path}

			




	
	
	
		
 
%endif

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## Locale to be used in the ssh-serve command.</%text>

			




	
	
	
		
 
<%text>## This is needed because an SSH client may try to use its own locale</%text>

			




	
	
	
		
 
<%text>## settings, which may not be available on the server.</%text>

			




	
	
	
		
 
<%text>## See `locale -a` for valid values on this system.</%text>

			




	
	
	
		
 
#ssh_locale = C.UTF-8

			




	
	
	
		
 

			




	
	
	
		
 
<%text>####################################</%text>

			




	
	
	
		
 
<%text>###        CELERY CONFIG        ####</%text>

			




	
	
	
		
 
<%text>####################################</%text>

			




	
	
	
		
 

			




	
	
	
		
 
use_celery = false

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## Example: connect to the virtual host 'rabbitmqhost' on localhost as rabbitmq:</%text>

			




	
	
	
		
 
broker.url = amqp://rabbitmq:qewqew@localhost:5672/rabbitmqhost

			




	
	
	
		
 

			




	
	
	
		
 
celery.imports = kallithea.lib.celerylib.tasks

			




	
	
	
		
 
celery.accept.content = pickle

			




	
	
	
		
 
celery.result.backend = amqp

			




	
	
	
		
 
celery.result.dburi = amqp://

			




	
	
	
		
 
celery.result.serialier = json

			




	
	
	
		
 

			




	
	
	
		
 
#celery.send.task.error.emails = true

			




	
	
	
		
 
#celery.amqp.task.result.expires = 18000

			




	
	
	
		
 

			




	
	
	
		
 
celeryd.concurrency = 2

			




	
	
	
		
 
celeryd.max.tasks.per.child = 1

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## If true, tasks will never be sent to the queue, but executed locally instead.</%text>

			




	
	
	
		
 
celery.always.eager = false

			




	
	
	
		
 

			




	
	
	
		
 
<%text>####################################</%text>

			




	
	
	
		
 
<%text>###         BEAKER CACHE        ####</%text>

			




	
	
	
		
 
<%text>####################################</%text>

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.data_dir = %(here)s/data/cache/data

			




	
	
	
		
 
beaker.cache.lock_dir = %(here)s/data/cache/lock

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.regions = short_term,long_term,sql_cache_short

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.short_term.type = memory

			




	
	
	
		
 
beaker.cache.short_term.expire = 60

			




	
	
	
		
 
beaker.cache.short_term.key_length = 256

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.long_term.type = memory

			




	
	
	
		
 
beaker.cache.long_term.expire = 36000

			




	
	
	
		
 
beaker.cache.long_term.key_length = 256

			




	
	
	
		
 

			




	
	
	
		
 
beaker.cache.sql_cache_short.type = memory

			




	
	
	
		
 
beaker.cache.sql_cache_short.expire = 10

			




	
	
	
		
 
beaker.cache.sql_cache_short.key_length = 256

			




	
	
	
		
 

			




	
	
	
		
 
<%text>####################################</%text>

			




	
	
	
		
 
<%text>###       BEAKER SESSION        ####</%text>

			




	
	
	
		
 
<%text>####################################</%text>

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.