Implement initial test for export-to-libmutton extension

2026-08-28 04:46:48 -04:00 · 2024-05-21 11:37:56 -04:00
parent e84e9569f3
commit df9d32c715
3 changed files with 69 additions and 0 deletions
@@ -0,0 +1,3 @@
+[config]
+input = export
+output = /usr/lib/sshyp/export-to-libmutton.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+
+from os import path, remove, system, walk
+from pathlib import Path
+from shutil import move, rmtree
+
+# NOTE LARGELY UNTESTED, ALPHA EXTENSION
+# TODO strip .gpg extension, if present
+# TODO extract and move MFA data to dedicated field, if present
+
+if __name__ == "__main__":
+    _pasture = path.expanduser('~/.local/share/sshyp')
+    
+    # set new gpg key; note that this changes sshyp's gpg key, not just libmutton's
+    gpg_config()
+
+    # remove previous export if it exists
+    if Path(f"{_pasture}.export").exists():
+        rmtree(f"{_pasture}.export")
+
+    # prompt for unlock and display do not close warning
+    decrypt(None)
+    curses_radio(['okay'], 'entry conversion may take some time (especially on slower devices)\n\nselect "okay" '
+                           'to start\n\ndo not terminate this process!')
+
+    # iterate over entires, exporting them in the libmutton format
+    if path.isdir(_pasture):
+        _gpg_id = sshyp_data.get('CLIENT-GENERAL', 'gpg_id')
+        for _dirPath, _dirNames, _filenames in walk(_pasture):
+            for _filename in sorted(_filenames):
+                # ensure parent directory within export tree exists
+                Path(dirPath.replace(_pasture, _pasture + '.export')).mkdir(0o700, parents=True, exist_ok=True)
+
+                # manually decrypt due to potential lack of .gpg extension
+                system(f"gpg -d '{_dirPath}/{_filename}' > '{_dirPath.replace(_pasture, _pasture + '.export')}/{_filename}'")
+
+                _old_contents, _new_contents = open(f"{_dirPath.replace(_pasture, _pasture + '.export')}/{_filename}", 'r').readlines(), ''
+
+                # add a new line reserved for libmutton's TOTP support (between username and URL)
+                for _num in range(len(_old_contents)):
+                    match _num:
+                        case 0:               
+                            _new_contents += _old_contents[0] 
+                        case 1:
+                            _new_contents += _old_contents[1]
+                        case 2:
+                            _new_contents += ''
+                        case 3:
+                            _new_contents += _old_contents[2]
+                        case _:
+                            _new_contents += _old_contents[_num]
+
+                # write and manually encrypt the output file
+                open(f"{_dirPath.replace(_pasture, _pasture + '.export')}/{_filename}", 'w').writelines(_new_contents)
+                system(f"gpg -qr {str(_gpg_id)} -e '{_dirPath.replace(_pasture, _pasture + '.export')}/{_filename}'")
+                remove(f"{_dirPath.replace(_pasture, _pasture + '.export')}/{_filename}")
+    else:
+        print(f"\n\u001b[38;5;9merror: no entry folder ({_pasture}) found\u001b[0m\n")
+        s_exit(2)
+
@@ -3,3 +3,9 @@ desc = reads mfa/2fa secrets from sshyp entries to generate and copy totp/Steam
 usage = sshyp /<entry name> copy -m<br><br>to add mfa data to a sshyp entry, insert it into the SECOND notes line for a given entry using the following format:<br><br>    otpauth://<OTP METHOD>/<ACCOUNT NAME, NOT USED>?secret=<SECRET>&issuer=<ISSUER, NOT USED>&algorithm=<ALGORITHM>&digits=<DIGITS>&period=<REFRESH PERIOD><br><br>what to put in each of the above spaces:<br><br>    <OTP METHOD> is almost always 'totp', but in the case of Steam, it needs to be set to 'steam'.<br>    <ACCOUNT NAME, NOT USED> is a part of the Authenticator backup format, but it is not used in sshyp-mfa. Set to anything.<br>    <SECRET> refers to the secret used to generate your MFA key. This is usually directly provided by the issuer, but it is sometimes hidden and more easily retrieved by copying it from a QR-compatible MFA app (such as Aegis).<br>    <ISSUER, NOT USED> is a part of the Authenticator backup format, but it is not used in sshyp-mfa. Set to anything.<br>    <ALGORITHM> refers to the algorithm used to generate your MFA key based on your secret. This is almost always 'sha1'.<br>    <DIGITS> refers to the intended length of your MFA key. This is almost always '6', but in the case of Steam, it needs to be set to '5'.<br>    <REFRESH PERIOD> refers to the interval at which a new MFA key needs to be generated. This is almost always '30', for 30 seconds.<br><br>examples:<br><br>    GitHub (standard 6-digit totp):<br>        otpauth://totp/MyNameIsBob?secret=YUGBSG65SG9SDBSDF56SBFVSC86SBVD6&issuer=GitHub&algorithm=sha1&digits=6&period=30<br><br>    Steam (5-character totp):<br>        otpauth://steam/SteamUser?secret=VGVG34GH2GJHVCK7HGVS7&issuer=Steam&algorithm=sha1&digits=5&period=30<br><br>for more information, visit:<br><br>    https://github.com/rwinkhart/sshyp-labs/wiki/sshyp-mfa
 exe = https://raw.githubusercontent.com/rwinkhart/sshyp-labs/v1.5.1.3/extensions/sshyp-mfa/sshyp-mfa.py
 ini = https://raw.githubusercontent.com/rwinkhart/sshyp-labs/v1.5.1.3/extensions/sshyp-mfa/sshyp-mfa.ini
+
+[export-to-libmutton]
+desc = ALPHA - DO NOT USE - exports sshyp entries to ~/.local/share/sshyp.export for use with libmutton v0.2.0
+usage = sshyp export
+exe = https://raw.githubusercontent.com/rwinkhart/sshyp-labs/main/extensions/export-to-libmutton/export-to-libmutton.py
+ini = https://raw.githubusercontent.com/rwinkhart/sshyp-labs/main/extensions/export-to-libmutton/export-to-libmutton.ini