paramiko.agent

Package paramiko :: Module agent |
[frames] | no frames]

# Source Code for Module paramiko.agent

      1  # Copyright (C) 2003-2007  John Rochester <john@jrochester.org>
      2  #
      3  # This file is part of paramiko.
      4  #
      5  # Paramiko is free software; you can redistribute it and/or modify it under the
      6  # terms of the GNU Lesser General Public License as published by the Free
      7  # Software Foundation; either version 2.1 of the License, or (at your option)
      8  # any later version.
      9  #
     10  # Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY
     11  # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
     12  # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
     13  # details.
     14  #
     15  # You should have received a copy of the GNU Lesser General Public License
     16  # along with Paramiko; if not, write to the Free Software Foundation, Inc.,
     17  # 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA.
     18
     19  """
     20  SSH Agent interface for Unix clients.
     21  """
     22
     23  import os
     24  import socket
     25  import struct
     26  import sys
     27  import threading
     28  import time
     29  import tempfile
     30  import stat
     31  from select import select
     32
     33  from paramiko.ssh_exception import SSHException
     34  from paramiko.message import Message
     35  from paramiko.pkey import PKey
     36  from paramiko.channel import Channel
     37  from paramiko.common import io_sleep
     38  from paramiko.util import retry_on_signal
     39
     40  SSH2_AGENTC_REQUEST_IDENTITIES, SSH2_AGENT_IDENTITIES_ANSWER, \
     41      SSH2_AGENTC_SIGN_REQUEST, SSH2_AGENT_SIGN_RESPONSE = range(11, 15)
     42
     43 -class AgentSSH(object):
     44      """
     45      Client interface for using private keys from an SSH agent running on the
     46      local machine.  If an SSH agent is running, this class can be used to
     47      connect to it and retreive L{PKey} objects which can be used when
     48      attempting to authenticate to remote SSH servers.
     49
     50      Because the SSH agent protocol uses environment variables and unix-domain
     51      sockets, this probably doesn't work on Windows.  It does work on most
     52      posix platforms though (Linux and MacOS X, for example).
     53      """
     54 -    def __init__(self):
     55          self._conn = None
     56          self._keys = ()
     57
     58 -    def get_keys(self):
     59          """
     60          Return the list of keys available through the SSH agent, if any.  If
     61          no SSH agent was running (or it couldn't be contacted), an empty list
     62          will be returned.
     63
     64          @return: a list of keys available on the SSH agent
     65          @rtype: tuple of L{AgentKey}
     66          """
     67          return self._keys
     68
     69 -    def _connect(self, conn):
     70          self._conn = conn
     71          ptype, result = self._send_message(chr(SSH2_AGENTC_REQUEST_IDENTITIES))
     72          if ptype != SSH2_AGENT_IDENTITIES_ANSWER:
     73              raise SSHException('could not get keys from ssh-agent')
     74          keys = []
     75          for i in range(result.get_int()):
     76              keys.append(AgentKey(self, result.get_string()))
     77              result.get_string()
     78          self._keys = tuple(keys)
     79
     80 -    def _close(self):
     81          #self._conn.close()
     82          self._conn = None
     83          self._keys = ()
     84
     85 -    def _send_message(self, msg):
     86          msg = str(msg)
     87          self._conn.send(struct.pack('>I', len(msg)) + msg)
     88          l = self._read_all(4)
     89          msg = Message(self._read_all(struct.unpack('>I', l)[0]))
     90          return ord(msg.get_byte()), msg
     91
     92 -    def _read_all(self, wanted):
     93          result = self._conn.recv(wanted)
     94          while len(result) < wanted:
     95              if len(result) == 0:
     96                  raise SSHException('lost ssh-agent')
     97              extra = self._conn.recv(wanted - len(result))
     98              if len(extra) == 0:
     99                  raise SSHException('lost ssh-agent')
    100              result += extra
    101          return result
    102
    103 -class AgentProxyThread(threading.Thread):
    104      """ Class in charge of communication between two chan """
    105 -    def __init__(self, agent):
    106          threading.Thread.__init__(self, target=self.run)
    107          self._agent = agent
    108          self._exit = False
    109
    110 -    def run(self):
    111          try:
    112              (r,addr) = self.get_connection()
    113              self.__inr = r
    114              self.__addr = addr
    115              self._agent.connect()
    116              self._communicate()
    117          except:
    118              #XXX Not sure what to do here ... raise or pass ?
    119              raise
    120
    121 -    def _communicate(self):
    122          import fcntl
    123          oldflags = fcntl.fcntl(self.__inr, fcntl.F_GETFL)
    124          fcntl.fcntl(self.__inr, fcntl.F_SETFL, oldflags | os.O_NONBLOCK)
    125          while not self._exit:
    126              events = select([self._agent._conn, self.__inr], [], [], 0.5)
    127              for fd in events[0]:
    128                  if self._agent._conn == fd:
    129                      data = self._agent._conn.recv(512)
    130                      if len(data) != 0:
    131                          self.__inr.send(data)
    132                      else:
    133                          self._close()
    134                          break
    135                  elif self.__inr == fd:
    136                      data = self.__inr.recv(512)
    137                      if len(data) != 0:
    138                          self._agent._conn.send(data)
    139                      else:
    140                          self._close()
    141                          break
    142              time.sleep(io_sleep)
    143
    144 -    def _close(self):
    145          self._exit = True
    146          self.__inr.close()
    147          self._agent._conn.close()
    148
    149 -class AgentLocalProxy(AgentProxyThread):
    150      """
    151      Class to be used when wanting to ask a local SSH Agent being
    152      asked from a remote fake agent (so use a unix socket for ex.)
    153      """
    154 -    def __init__(self, agent):
    155          AgentProxyThread.__init__(self, agent)
    156
    157 -    def get_connection(self):
    158          """ Return a pair of socket object and string address
    159          May Block !
    160          """
    161          conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    162          try:
    163              conn.bind(self._agent._get_filename())
    164              conn.listen(1)
    165              (r,addr) = conn.accept()
    166              return (r, addr)
    167          except:
    168              raise
    169          return None
    170
    171 -class AgentRemoteProxy(AgentProxyThread):
    172      """
    173      Class to be used when wanting to ask a remote SSH Agent
    174      """
    175 -    def __init__(self, agent, chan):
    176          AgentProxyThread.__init__(self, agent)
    177          self.__chan = chan
    178
    179 -    def get_connection(self):
    180          """
    181          Class to be used when wanting to ask a local SSH Agent being
    182          asked from a remote fake agent (so use a unix socket for ex.)
    183          """
    184          return (self.__chan, None)
    185
    186 -class AgentClientProxy(object):
    187      """
    188      Class proxying request as a client:
    189         -> client ask for a request_forward_agent()
    190         -> server creates a proxy and a fake SSH Agent
    191         -> server ask for establishing a connection when needed,
    192         calling the forward_agent_handler at client side.
    193         -> the forward_agent_handler launch a thread for connecting
    194         the remote fake agent and the local agent
    195         -> Communication occurs ...
    196      """
    197 -    def __init__(self, chanRemote):
    198          self._conn = None
    199          self.__chanR = chanRemote
    200          self.thread = AgentRemoteProxy(self, chanRemote)
    201          self.thread.start()
    202
    203 -    def __del__(self):
    204          self.close()
    205
    206 -    def connect(self):
    207          """
    208          Method automatically called by the run() method of the AgentProxyThread
    209          """
    210          if ('SSH_AUTH_SOCK' in os.environ) and (sys.platform != 'win32'):
    211              conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    212              try:
    213                  retry_on_signal(lambda: conn.connect(os.environ['SSH_AUTH_SOCK']))
    214              except:
    215                  # probably a dangling env var: the ssh agent is gone
    216                  return
    217          elif sys.platform == 'win32':
    218              import win_pageant
    219              if win_pageant.can_talk_to_agent():
    220                  conn = win_pageant.PageantConnection()
    221              else:
    222                  return
    223          else:
    224              # no agent support
    225              return
    226          self._conn = conn
    227
    228 -    def close(self):
    229          """
    230          Close the current connection and terminate the agent
    231          Should be called manually
    232          """
    233          if hasattr(self, "thread"):
    234              self.thread._exit = True
    235              self.thread.join(1000)
    236          if self._conn is not None:
    237              self._conn.close()
    238
    239 -class AgentServerProxy(AgentSSH):
    240      """
    241      @param t : transport used for the Forward for SSH Agent communication
    242
    243      @raise SSHException: mostly if we lost the agent
    244      """
    245 -    def __init__(self, t):
    246          AgentSSH.__init__(self)
    247          self.__t = t
    248          self._dir = tempfile.mkdtemp('sshproxy')
    249          os.chmod(self._dir, stat.S_IRWXU)
    250          self._file = self._dir + '/sshproxy.ssh'
    251          self.thread = AgentLocalProxy(self)
    252          self.thread.start()
    253
    254 -    def __del__(self):
    255          self.close()
    256
    257 -    def connect(self):
    258          conn_sock = self.__t.open_forward_agent_channel()
    259          if conn_sock is None:
    260              raise SSHException('lost ssh-agent')
    261          conn_sock.set_name('auth-agent')
    262          self._connect(conn_sock)
    263
    264 -    def close(self):
    265          """
    266          Terminate the agent, clean the files, close connections
    267          Should be called manually
    268          """
    269          os.remove(self._file)
    270          os.rmdir(self._dir)
    271          self.thread._exit = True
    272          self.thread.join(1000)
    273          self._close()
    274
    275 -    def get_env(self):
    276          """
    277          Helper for the environnement under unix
    278
    279          @return: the SSH_AUTH_SOCK Environnement variables
    280          @rtype: dict
    281          """
    282          env = {}
    283          env['SSH_AUTH_SOCK'] = self._get_filename()
    284          return env
    285
    286 -    def _get_filename(self):
    287          return self._file
    288
    289 -class AgentRequestHandler(object):
    290 -    def __init__(self, chanClient):
    291          self._conn = None
    292          self.__chanC = chanClient
    293          chanClient.request_forward_agent(self._forward_agent_handler)
    294          self.__clientProxys = []
    295
    296 -    def _forward_agent_handler(self, chanRemote):
    297          self.__clientProxys.append(AgentClientProxy(chanRemote))
    298
    299 -    def __del__(self):
    300          self.close()
    301
    302 -    def close(self):
    303          for p in self.__clientProxys:
    304              p.close()
    305
    306 -class Agent(AgentSSH):
    307      """
    308      Client interface for using private keys from an SSH agent running on the
    309      local machine.  If an SSH agent is running, this class can be used to
    310      connect to it and retreive L{PKey} objects which can be used when
    311      attempting to authenticate to remote SSH servers.
    312
    313      Because the SSH agent protocol uses environment variables and unix-domain
    314      sockets, this probably doesn't work on Windows.  It does work on most
    315      posix platforms though (Linux and MacOS X, for example).
    316      """
    317
    318 -    def __init__(self):
    319          """
    320          Open a session with the local machine's SSH agent, if one is running.
    321          If no agent is running, initialization will succeed, but L{get_keys}
    322          will return an empty tuple.
    323
    324          @raise SSHException: if an SSH agent is found, but speaks an
    325              incompatible protocol
    326          """
    327          AgentSSH.__init__(self)
    328
    329          if ('SSH_AUTH_SOCK' in os.environ) and (sys.platform != 'win32'):
    330              conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    331              try:
    332                  conn.connect(os.environ['SSH_AUTH_SOCK'])
    333              except:
    334                  # probably a dangling env var: the ssh agent is gone
    335                  return
    336          elif sys.platform == 'win32':
    337              import win_pageant
    338              if win_pageant.can_talk_to_agent():
    339                  conn = win_pageant.PageantConnection()
    340              else:
    341                  return
    342          else:
    343              # no agent support
    344              return
    345          self._connect(conn)
    346
    347 -    def close(self):
    348          """
    349          Close the SSH agent connection.
    350          """
    351          self._close()
    352
    353 -class AgentKey(PKey):
    354      """
    355      Private key held in a local SSH agent.  This type of key can be used for
    356      authenticating to a remote server (signing).  Most other key operations
    357      work as expected.
    358      """
    359
    360 -    def __init__(self, agent, blob):
    361          self.agent = agent
    362          self.blob = blob
    363          self.name = Message(blob).get_string()
    364
    365 -    def __str__(self):
    366          return self.blob
    367
    368 -    def get_name(self):
    369          return self.name
    370
    371 -    def sign_ssh_data(self, rng, data):
    372          msg = Message()
    373          msg.add_byte(chr(SSH2_AGENTC_SIGN_REQUEST))
    374          msg.add_string(self.blob)
    375          msg.add_string(data)
    376          msg.add_int(0)
    377          ptype, result = self.agent._send_message(msg)
    378          if ptype != SSH2_AGENT_SIGN_RESPONSE:
    379              raise SSHException('key cannot be used for signing')
    380          return result.get_string()
    381