Package paramiko :: Module agent
[frames] | no frames]

Source Code for Module paramiko.agent

  1  # Copyright (C) 2003-2007  John Rochester <john@jrochester.org> 
  2  # 
  3  # This file is part of paramiko. 
  4  # 
  5  # Paramiko is free software; you can redistribute it and/or modify it under the 
  6  # terms of the GNU Lesser General Public License as published by the Free 
  7  # Software Foundation; either version 2.1 of the License, or (at your option) 
  8  # any later version. 
  9  # 
 10  # Paramiko is distrubuted in the hope that it will be useful, but WITHOUT ANY 
 11  # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR 
 12  # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more 
 13  # details. 
 14  # 
 15  # You should have received a copy of the GNU Lesser General Public License 
 16  # along with Paramiko; if not, write to the Free Software Foundation, Inc., 
 17  # 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA. 
 18   
 19  """ 
 20  SSH Agent interface for Unix clients. 
 21  """ 
 22   
 23  import os 
 24  import socket 
 25  import struct 
 26  import sys 
 27  import threading 
 28  import time 
 29  import tempfile 
 30  import stat 
 31  from select import select 
 32   
 33  from paramiko.ssh_exception import SSHException 
 34  from paramiko.message import Message 
 35  from paramiko.pkey import PKey 
 36  from paramiko.channel import Channel 
 37  from paramiko.common import io_sleep 
 38  from paramiko.util import retry_on_signal 
 39   
 40  SSH2_AGENTC_REQUEST_IDENTITIES, SSH2_AGENT_IDENTITIES_ANSWER, \ 
 41      SSH2_AGENTC_SIGN_REQUEST, SSH2_AGENT_SIGN_RESPONSE = range(11, 15) 
 42   
43 -class AgentSSH(object):
44 """ 45 Client interface for using private keys from an SSH agent running on the 46 local machine. If an SSH agent is running, this class can be used to 47 connect to it and retreive L{PKey} objects which can be used when 48 attempting to authenticate to remote SSH servers. 49 50 Because the SSH agent protocol uses environment variables and unix-domain 51 sockets, this probably doesn't work on Windows. It does work on most 52 posix platforms though (Linux and MacOS X, for example). 53 """
54 - def __init__(self):
55 self._conn = None 56 self._keys = ()
57
58 - def get_keys(self):
59 """ 60 Return the list of keys available through the SSH agent, if any. If 61 no SSH agent was running (or it couldn't be contacted), an empty list 62 will be returned. 63 64 @return: a list of keys available on the SSH agent 65 @rtype: tuple of L{AgentKey} 66 """ 67 return self._keys
68
69 - def _connect(self, conn):
70 self._conn = conn 71 ptype, result = self._send_message(chr(SSH2_AGENTC_REQUEST_IDENTITIES)) 72 if ptype != SSH2_AGENT_IDENTITIES_ANSWER: 73 raise SSHException('could not get keys from ssh-agent') 74 keys = [] 75 for i in range(result.get_int()): 76 keys.append(AgentKey(self, result.get_string())) 77 result.get_string() 78 self._keys = tuple(keys)
79
80 - def _close(self):
81 #self._conn.close() 82 self._conn = None 83 self._keys = ()
84
85 - def _send_message(self, msg):
86 msg = str(msg) 87 self._conn.send(struct.pack('>I', len(msg)) + msg) 88 l = self._read_all(4) 89 msg = Message(self._read_all(struct.unpack('>I', l)[0])) 90 return ord(msg.get_byte()), msg
91
92 - def _read_all(self, wanted):
93 result = self._conn.recv(wanted) 94 while len(result) < wanted: 95 if len(result) == 0: 96 raise SSHException('lost ssh-agent') 97 extra = self._conn.recv(wanted - len(result)) 98 if len(extra) == 0: 99 raise SSHException('lost ssh-agent') 100 result += extra 101 return result
102
103 -class AgentProxyThread(threading.Thread):
104 """ Class in charge of communication between two chan """
105 - def __init__(self, agent):
106 threading.Thread.__init__(self, target=self.run) 107 self._agent = agent 108 self._exit = False
109
110 - def run(self):
111 try: 112 (r,addr) = self.get_connection() 113 self.__inr = r 114 self.__addr = addr 115 self._agent.connect() 116 self._communicate() 117 except: 118 #XXX Not sure what to do here ... raise or pass ? 119 raise
120
121 - def _communicate(self):
122 import fcntl 123 oldflags = fcntl.fcntl(self.__inr, fcntl.F_GETFL) 124 fcntl.fcntl(self.__inr, fcntl.F_SETFL, oldflags | os.O_NONBLOCK) 125 while not self._exit: 126 events = select([self._agent._conn, self.__inr], [], [], 0.5) 127 for fd in events[0]: 128 if self._agent._conn == fd: 129 data = self._agent._conn.recv(512) 130 if len(data) != 0: 131 self.__inr.send(data) 132 else: 133 self._close() 134 break 135 elif self.__inr == fd: 136 data = self.__inr.recv(512) 137 if len(data) != 0: 138 self._agent._conn.send(data) 139 else: 140 self._close() 141 break 142 time.sleep(io_sleep)
143
144 - def _close(self):
145 self._exit = True 146 self.__inr.close() 147 self._agent._conn.close()
148
149 -class AgentLocalProxy(AgentProxyThread):
150 """ 151 Class to be used when wanting to ask a local SSH Agent being 152 asked from a remote fake agent (so use a unix socket for ex.) 153 """
154 - def __init__(self, agent):
156
157 - def get_connection(self):
158 """ Return a pair of socket object and string address 159 May Block ! 160 """ 161 conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) 162 try: 163 conn.bind(self._agent._get_filename()) 164 conn.listen(1) 165 (r,addr) = conn.accept() 166 return (r, addr) 167 except: 168 raise 169 return None
170
171 -class AgentRemoteProxy(AgentProxyThread):
172 """ 173 Class to be used when wanting to ask a remote SSH Agent 174 """
175 - def __init__(self, agent, chan):
176 AgentProxyThread.__init__(self, agent) 177 self.__chan = chan
178
179 - def get_connection(self):
180 """ 181 Class to be used when wanting to ask a local SSH Agent being 182 asked from a remote fake agent (so use a unix socket for ex.) 183 """ 184 return (self.__chan, None)
185
186 -class AgentClientProxy(object):
187 """ 188 Class proxying request as a client: 189 -> client ask for a request_forward_agent() 190 -> server creates a proxy and a fake SSH Agent 191 -> server ask for establishing a connection when needed, 192 calling the forward_agent_handler at client side. 193 -> the forward_agent_handler launch a thread for connecting 194 the remote fake agent and the local agent 195 -> Communication occurs ... 196 """
197 - def __init__(self, chanRemote):
198 self._conn = None 199 self.__chanR = chanRemote 200 self.thread = AgentRemoteProxy(self, chanRemote) 201 self.thread.start()
202
203 - def __del__(self):
204 self.close()
205
206 - def connect(self):
207 """ 208 Method automatically called by the run() method of the AgentProxyThread 209 """ 210 if ('SSH_AUTH_SOCK' in os.environ) and (sys.platform != 'win32'): 211 conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) 212 try: 213 retry_on_signal(lambda: conn.connect(os.environ['SSH_AUTH_SOCK'])) 214 except: 215 # probably a dangling env var: the ssh agent is gone 216 return 217 elif sys.platform == 'win32': 218 import win_pageant 219 if win_pageant.can_talk_to_agent(): 220 conn = win_pageant.PageantConnection() 221 else: 222 return 223 else: 224 # no agent support 225 return 226 self._conn = conn
227
228 - def close(self):
229 """ 230 Close the current connection and terminate the agent 231 Should be called manually 232 """ 233 if hasattr(self, "thread"): 234 self.thread._exit = True 235 self.thread.join(1000) 236 if self._conn is not None: 237 self._conn.close()
238
239 -class AgentServerProxy(AgentSSH):
240 """ 241 @param t : transport used for the Forward for SSH Agent communication 242 243 @raise SSHException: mostly if we lost the agent 244 """
245 - def __init__(self, t):
246 AgentSSH.__init__(self) 247 self.__t = t 248 self._dir = tempfile.mkdtemp('sshproxy') 249 os.chmod(self._dir, stat.S_IRWXU) 250 self._file = self._dir + '/sshproxy.ssh' 251 self.thread = AgentLocalProxy(self) 252 self.thread.start()
253
254 - def __del__(self):
255 self.close()
256
257 - def connect(self):
258 conn_sock = self.__t.open_forward_agent_channel() 259 if conn_sock is None: 260 raise SSHException('lost ssh-agent') 261 conn_sock.set_name('auth-agent') 262 self._connect(conn_sock)
263
264 - def close(self):
265 """ 266 Terminate the agent, clean the files, close connections 267 Should be called manually 268 """ 269 os.remove(self._file) 270 os.rmdir(self._dir) 271 self.thread._exit = True 272 self.thread.join(1000) 273 self._close()
274
275 - def get_env(self):
276 """ 277 Helper for the environnement under unix 278 279 @return: the SSH_AUTH_SOCK Environnement variables 280 @rtype: dict 281 """ 282 env = {} 283 env['SSH_AUTH_SOCK'] = self._get_filename() 284 return env
285
286 - def _get_filename(self):
287 return self._file
288
289 -class AgentRequestHandler(object):
290 - def __init__(self, chanClient):
291 self._conn = None 292 self.__chanC = chanClient 293 chanClient.request_forward_agent(self._forward_agent_handler) 294 self.__clientProxys = []
295
296 - def _forward_agent_handler(self, chanRemote):
297 self.__clientProxys.append(AgentClientProxy(chanRemote))
298
299 - def __del__(self):
300 self.close()
301
302 - def close(self):
303 for p in self.__clientProxys: 304 p.close()
305
306 -class Agent(AgentSSH):
307 """ 308 Client interface for using private keys from an SSH agent running on the 309 local machine. If an SSH agent is running, this class can be used to 310 connect to it and retreive L{PKey} objects which can be used when 311 attempting to authenticate to remote SSH servers. 312 313 Because the SSH agent protocol uses environment variables and unix-domain 314 sockets, this probably doesn't work on Windows. It does work on most 315 posix platforms though (Linux and MacOS X, for example). 316 """ 317
318 - def __init__(self):
319 """ 320 Open a session with the local machine's SSH agent, if one is running. 321 If no agent is running, initialization will succeed, but L{get_keys} 322 will return an empty tuple. 323 324 @raise SSHException: if an SSH agent is found, but speaks an 325 incompatible protocol 326 """ 327 AgentSSH.__init__(self) 328 329 if ('SSH_AUTH_SOCK' in os.environ) and (sys.platform != 'win32'): 330 conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) 331 try: 332 conn.connect(os.environ['SSH_AUTH_SOCK']) 333 except: 334 # probably a dangling env var: the ssh agent is gone 335 return 336 elif sys.platform == 'win32': 337 import win_pageant 338 if win_pageant.can_talk_to_agent(): 339 conn = win_pageant.PageantConnection() 340 else: 341 return 342 else: 343 # no agent support 344 return 345 self._connect(conn)
346
347 - def close(self):
348 """ 349 Close the SSH agent connection. 350 """ 351 self._close()
352
353 -class AgentKey(PKey):
354 """ 355 Private key held in a local SSH agent. This type of key can be used for 356 authenticating to a remote server (signing). Most other key operations 357 work as expected. 358 """ 359
360 - def __init__(self, agent, blob):
361 self.agent = agent 362 self.blob = blob 363 self.name = Message(blob).get_string()
364
365 - def __str__(self):
366 return self.blob
367
368 - def get_name(self):
369 return self.name
370
371 - def sign_ssh_data(self, rng, data):
372 msg = Message() 373 msg.add_byte(chr(SSH2_AGENTC_SIGN_REQUEST)) 374 msg.add_string(self.blob) 375 msg.add_string(data) 376 msg.add_int(0) 377 ptype, result = self.agent._send_message(msg) 378 if ptype != SSH2_AGENT_SIGN_RESPONSE: 379 raise SSHException('key cannot be used for signing') 380 return result.get_string()
381