snazzer-send-wrapper

#!/bin/sh -e
set -e
export PATH=/bin:/usr/bin:/sbin:/usr/local/bin

log_cmd() {
    MSG="$0 (for $SSH_CLIENT)  running: $SSH_ORIGINAL_COMMAND"
    logger -p user.info "$MSG"
}

log_cmd_and_exit() {
    MSG="$0 (for $SSH_CLIENT) REJECTED: $SSH_ORIGINAL_COMMAND"
    if [ -n "$2" ];
        then MSG="$MSG ### REASON: $2"
    fi
    logger -p user.error "$MSG"
    echo "$MSG" >&2
    if [ -n "$1" -a "$1" != "0" ]; then
        exit "$1"
    else
        exit 1
    fi
}

squote_args() {
    while [ -n "$1" ]; do
        printf "'"; printf '%s' "$1" | sed "s|'|'\\\\''|g"; printf "' "
        shift
    done
}

# The mission: unpack an $SSH_ORIGINAL_COMMAND-like variable with an arbitrary
# number arguments to our command of interest into "$@" so that we can call our
# real command safely. In other words, instead of something like:
#   foo $DANGEROUS_BAREWORD_STRING
# we want to do instead:
#   foo "$@"
#
# ASSUMPTION: All arguments are inside single-quoted strings using '\'' to
# escape internal single quotes (and we interpolate '\'' -> ' for you). So
# instead of:
#   bla --bar --cat=" someone's dog " --foo='a "b" c'
# ARGS must be of the form:
#   'bla' '--bar' '--cat=" someone'\''s dog "' '--foo='\''a "b" c'\'''
#
# SMELL: We haven't really thought through erroneous backslashes, but that
# should only cause arg mangling, shouldn't result in any shell escape vuln as
# long as the real command can handle it (!) and is called using "$@"
#
# IMPORTANT: Refer to tests/snazzer-send-wrapper.bats test cases
dispatch_cmd() {
    CMD=$1
    ARGS=$2
    ARGN=
    PHASE=right

    shift
    shift
    [ -n "$CMD" -a -n "$ARGS" ]
    if ! echo "$ARGS" | grep -q "^ *'.*' *$"; then
        log_cmd_and_exit 99 "Args must start and end with single-quotes"
    fi
    # We parse from right-to-left, because we're (ab)using sed and it doesn't do
    # non-greedy regex matching. It works by chopping the end off $ARGS
    # progressively until there's nothing left. $ARGN accumulates the truncated
    # bits for the right-most argument and is reset back to the empty string
    # once it is done and pushed onto "$@". Am I mad? A real language'd be nice
    while [ -n "$ARGS" ]
    do
        case "$PHASE" in
            right)
                ARGN="$(echo "$ARGS" | sed -n "s|^.*'\([^']*\)' *$|\1|p")$ARGN"
                ARGS=$(echo "$ARGS"    | sed    "s|\([^']*\)' *$||")
                # If truncation up to final ' is same as truncation up to '\'',
                # need to split this argument so we can interpolate '\'' -> '
                if [ "$(echo "$ARGS" | sed "s/^.*'//g")" = \
                     "$(echo "$ARGS" | sed "s/^.*'\\\\''//g")" ]; then
                    PHASE=split
                # Otherwise this is a boring argument without any '\'' in it
                elif echo "$ARGS" | grep -q "'$"; then
                    PHASE=left
                else
                    log_cmd_and_exit 99 "This should never happen, stopped: $ARGS"
                fi
                ;;
            split)
                L=$(echo "$ARGS" | sed -n "s|^\(.*\)'\\\\''\(.*\)$|\1|p")
                R=$(echo "$ARGS" | sed -n "s|^\(.*\)'\\\\''\(.*\)$|\2|p")
                # If there are no '\'' left at all in $ARGS, stop splitting
                if [ -z "$L" -a -z "$R" ]; then
                    PHASE=left
                # If truncation up to final ' is the same as truncation up to
                # '\'', we're still processing current ARGN, keep splitting
                elif [ "$(echo "$L" | sed "s/^.*'//g")" = \
                     "$(echo "$L" | sed "s/^.*'\\\\''//g")" ]
                then
                    ARGS="$L"
                    ARGN="'$R${ARGN}"
                # Otherwise, our right-most single-quote marks that we reached
                # the beginning of the current ARGN, so stop splitting
                else
                    PHASE=left
                    ARGS="$L"
                    ARGN="'$R${ARGN}"
                fi
                ;;
            left)
                ARGN="$(echo "$ARGS" | sed -n "s|^.* *'\([^']*\)$|\1|p")$ARGN"
                ARGS=$(echo "$ARGS"             | sed       "s| *'\([^']*\)$||")
                set -- "$ARGN" "$@"
                ARGN=
                PHASE=right
                ;;
            *)
                log_cmd_and_exit 99 "This should never happen, stopped: $ARGS"
                ;;
        esac
    done
    case "$CMD" in
        list_snapshots)
            log_cmd "sudo -n snazzer --list-snapshots $(squote_args "$@")"
            for ARG in "$@"; do
                if [ "$ARG" != "--all" -a "$(echo "$ARG" | cut -c 1)" = "-" ];
                then
                    log_cmd_and_exit 98 "list-snapshots: non-switch args only"
                fi
            done
            sudo -n snazzer --list-snapshots "$@"
            ;;
        btrfs_send_p)
            if [ "$#" = "3" -a "$2" = "-p" -a "$(echo "$1" | cut -c 1)" != "-" \
                -a "$(echo "$3" | cut -c 1)" != "-" ];
            then
                log_cmd "sudo -n btrfs send $(squote_args "$1") -p $(squote_args "$3")"
                sudo -n btrfs send "$1" -p "$3"
            else
                log_cmd_and_exit 98 "btrfs send X -p Y bad no. args or switches"
            fi
            ;;
        btrfs_send)
            if [ "$#" = "1" -a "$(echo "$1" | cut -c 1)" != "-" ]; then
                log_cmd "sudo -n btrfs send $(squote_args "$1")"
                sudo -n btrfs send "$1"
            else
                log_cmd_and_exit 98 "btrfs send X bad no. args or switches"
            fi
            ;;
        grep_srl)
            if [ "$#" = "2" -a "$(echo "$1" | cut -c 1)" != "-" -a \
                "$(echo "$2" | cut -c 1)" != "-" ]; then
                log_cmd "sudo -n grep -srl $(squote_args "$1") $(squote_args "$2")"
                sudo -n grep -srl "$1" "$2"
            else
                log_cmd_and_exit 98 "grep -srl must have two non-switch arguments"
            fi
            ;;
        cat_measurement)
            if [ "$#" = "1" -a "$(echo "$1" | cut -c 1)" != "-" ]; then
                log_cmd "sudo -n cat $(squote_args "$1")"
                sudo -n cat "$1"
            else
                log_cmd_and_exit 98 "cat: single non-switch argument only"
            fi
            ;;
        *)
            log_cmd_and_exit 127 "Bad dispatch '$CMD', this should never happen"
            ;;
    esac
}

run_cmd() {
    CMD=$1
    case "$CMD" in
        "sudo -n snazzer --list-snapshots"*)
            ARGS="$(echo "$CMD" | sed "s|^sudo -n snazzer --list-snapshots ||g")"
            dispatch_cmd "list_snapshots" "$ARGS"
            ;;
        "sudo -n grep -srl '^> on "*"' '"*"/.snapshotz/.measurements/'")
            ARGS="$(echo "$CMD" | sed "s|^sudo -n grep -srl ||g")"
            dispatch_cmd "grep_srl" "$ARGS"
            ;;
        "sudo -n btrfs send '"*"/.snapshotz/"*"' '-p' '"*"/.snapshotz/"*"'")
            ARGS="$(echo "$CMD" | sed "s|^sudo -n btrfs send ||g")"
            dispatch_cmd "btrfs_send_p" "$ARGS"
            ;;
        "sudo -n btrfs send '"*"/.snapshotz/"*"'")
            ARGS="$(echo "$CMD" | sed "s|^sudo -n btrfs send ||g")"
            dispatch_cmd "btrfs_send" "$ARGS"
            ;;
        "sudo -n cat '"*"/.snapshotz/.measurements/"*"'")
            ARGS="$(echo "$CMD" | sed "s|^sudo -n cat ||g")"
            dispatch_cmd "cat_measurement" "$ARGS"
            ;;
        *)
            cat <<HERE >&2
ERROR: Unrecognized command (are paths good, arguments single-quoted?):
  $CMD
HERE
            exit 2
    esac
}

case "$1" in
    -h | --help ) pod2usage -exit 0 "$0"; exit ;;
         --man ) pod2usage -exit 0 -verbose 3 "$0"; exit ;;
         --man-roff ) pod2man --release="$SNAZZER_VERSION" "$0"; exit ;;
         --man-markdown )
             cat <<HERE | perl -Mstrict
if ( eval { require Pod::Markdown; 1; } ) {
    Pod::Markdown->new->filter('$0');
}
else {
    print STDERR "ERROR: --man-markdown requires Pod::Markdown\n\$@\n";
    exit 9;
}
HERE
             exit
             ;;
    "")
            if [ -n "$SSH_ORIGINAL_COMMAND" ]; then
                run_cmd "$SSH_ORIGINAL_COMMAND"
            else
                pod2usage -exit 1 "$0";
                exit
            fi
            ;;
    * ) echo "ERROR: Invalid argument '$1'" >&2 ; exit ;;
esac

<<__DNE__
__END__
=head1 NAME

snazzer-send-wrapper - ssh forced command wrapper for snazzer-receive

=head1 SYNOPSIS

  SSH_ORIGINAL_COMMAND="sudo -n snazzer --list-snapshots '--all'" \
    ./snazzer-send-wrapper

  SSH_ORIGINAL_COMMAND="sudo -n grep -srl \
    'sendinghost1' '/some/.snapshotz/.measurements/'" snazzer-send-wrapper

  SSH_ORIGINAL_COMMAND="sudo -n btrfs send \
    '/some/.snapshotz/2015-04-01T000000Z'" snazzer-send-wrapper

  SSH_ORIGINAL_COMMAND="sudo -n cat \
    '/some/.snapshotz/.measurements/2015-04-01T000000Z'" snazzer-send-wrapper

=head1 OPTIONS

=over

=item B<--help>: Brief help message

=item B<--man>: Full documentation

=item B<--man-roff>: Full documentation as *roff output, Eg:

    snazzer --man-roff | nroff -man

=item B<--man-markdown>: Full documentation as markdown output, Eg:

    snazzer --man-markdown > snazzer-manpage.md

=back

=head1 DESCRIPTION

This is a wrapper script to be used in place of a real login shell (Eg. as an
ssh(1) forced command) in order to restrict the commands available to the user
account used by B<snazzer-receive> to run C<btrfs send>. It may be utilized by
adding an entry in the C<~/.ssh/authorized_keys> file on the sending host (Eg.
C<sendinghost1>) under the user account used by B<snazzer-receive> to run
C<btrfs send>.  C<~/.ssh/authorized_keys>:

    command="/usr/bin/snazzer-send-wrapper",no-port-forwarding, \
        no-X11-forwarding,no-pty ssh-rsa AAAA...snip...== my key

And then (as an example) receive btrfs snapshots from this C<sendinghost1>:

    snazzer-receive sendinghost1 --all

=head1 ENVIRONMENT

=over

=item * SSH_ORIGINAL_COMMAND

This variable holds the original remote ssh command to be acted upon.

=back

=head1 BUGS AND LIMITATIONS

=over

=item * This script tries too hard to parse normal shell commands

A better design would be custom command tokens issued with more easily parsed
string and argument delimeters. This would require some changes to
B<snazzer-receive>.

A mitigating factor is that all commands are executed in the form of:

  foo "$@"

Rather than any variant of the more exciting:

  foo $BAREWORD_ARGUMENTS

or

  eval "$SSH_ORIGINAL_COMMAND"

This wrapper script is also sanity-checked with bats regression tests which
check that only the correct number of arguments, valid arguments, switches,
path patterns and escape characters are dealt with - anything else is rejected. 

=back

=head1 EXIT STATUS

B<snazzer-send-wrapper> will abort with an error message printed to STDERR and
non-zero exit status under the following conditions:

=over

=item 2. the command string was not recognized

=item 98. the command string was recognized but the arguments were not safe

=item 99. the command string was recognized and an attempt was made to
parse/re-pack the arguments however the argument string had dangling quotes or
otherwise confused the parser/"$@" unpacker

=back

=head1 SEE ALSO

snazzer-receive

=head1 AUTHOR

Paul Harvey <csirac2@gmail.com>, https://github.com/csirac2/snazzer

=head1 LICENSE AND COPYRIGHT

Copyright (c) 2015, Paul Harvey <csirac2@gmail.com> All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
=cut
__DNE__