summaryrefslogtreecommitdiff
path: root/update-openssh-known-hosts
blob: be7e9d78d6322f75fe3ab32669759211f5258621 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
#!/bin/bash

set -euC

CONFDIR=${CONFDIR:-/etc/openssh-known-hosts}
PLUGIN_PATH=${PLUGIN_PATH:-/usr/local/share/openssh-known-hosts/plugins:/usr/share/openssh-known-hosts/plugins}
CACHEDIR=${CACHEDIR:-/var/cache/openssh-known-hosts}
LOCK=${LOCK:-/var/lock/openssh-known-hosts}
OUTFILE=${OUTFILE:-/var/lib/openssh-known-hosts/ssh_known_hosts}

path_search () {
	search="$1"
	shift
	local IFS
	IFS=:
	set -- $@
	if [[ ${search} =~ / ]]; then
		echo "${search}"
		return 0
	fi
	for path; do
		if [ -f "${path}/${search}" ]; then
			echo "${path}/${search}"
			return 0
		fi
	done
	echo "'${search}' not found in '$@'!" >&2
	exit 127
}

cleanup () {
	rm -f "${OUTFILE}.new"
	kill "${LOCKPID}"
	lockfile-remove "${LOCK}"
}

if [ $# -eq 1 ] && [ "$1" = "-f" ]; then
	fail=1
else
	fail=''
fi

trap cleanup EXIT

lockfile-create "${LOCK}"
lockfile-touch "${LOCK}" &
LOCKPID="$!"

mkdir -p "${CACHEDIR}"
cd "${CACHEDIR}"

find -mindepth 2 -maxdepth 2 -type f -name new -delete

run-parts --list "${CONFDIR}/sources/" | while read sourcefile; do
	source=${sourcefile##*/}
	mkdir -p ${source}
	(
		set -a
		cd ${source}
		. "${sourcefile}"
		$(path_search "$PLUGIN" "$PLUGIN_PATH") >| log 2>&1 || {
			exitcode=$?
			rm -f new
			ignore=''
			for e in ${EXIT_IGNORE:-0}; do
				if [[ $e = $exitcode ]]; then
					ignore=1
					break
				fi
			done
			if [ -z "$ignore" -o "$fail" ]; then
				echo "${source} exited with code ${exitcode}, log follows:"
				cat log
				echo
			fi
			if [ "$fail" ]; then
				exit 1
			fi
		} >&2
	) || exit 1
	if [ -e ${source}/new ]; then
		mv ${source}/new ${source}/current
	fi
	if [ -e ${source}/current ]; then
		if [ -e "${sourcefile}.filter" ]; then
			if [[ ${source}/filtered -ot ${source}/current ]] || [[ ${source}/filtered -ot ${sourcefile}.filter ]]; then
				mapfile -t filter < "${sourcefile}.filter"
				for i in ${!filter[@]}; do
					if [[ ${filter[$i]} =~ ^($|#) ]]; then
						unset filter[$i]
					fi
				done
				while read hostlist rest; do
					IFS=, read -a hostarray <<<$hostlist
					new_hostlist=''
					for host in ${hostarray[@]}; do
						for rule in "${filter[@]}"; do
							if [[ ${host} =~ ${rule#* } ]]; then
								if [[ ${rule%% *} =~ ^[aopy] ]]; then
									new_hostlist="${new_hostlist}${host},"
								fi
								break
							fi
						done
					done
					[ "$new_hostlist" ] || continue
					echo "${new_hostlist%,} ${rest}"
				done < ${source}/current | sort -u >| ${source}/filtered.new
				mv ${source}/filtered.new ${source}/filtered
			fi
			cat ${source}/filtered >&3
		else
			sort -u ${source}/current >&3
		fi
	fi
done 3>| "${OUTFILE}.new"

if cmp -s "${OUTFILE}" "${OUTFILE}.new"; then
	rm "${OUTFILE}.new"
else
	mv "${OUTFILE}.new" "${OUTFILE}"
fi

# clean up cache dirs of vanished sources
for d in *; do
	[ -d $d ] || continue
	[ -e "${CONFDIR}/sources/$d" ] || rm -fr $d
done

# vim:set ft=sh: