Package ssh :: Module agent
[frames] | no frames]

Source Code for Module ssh.agent

  1  # Copyright (C) 2011  John Rochester <john@jrochester.org> 
  2  # 
  3  # This file is part of ssh. 
  4  # 
  5  # 'ssh' is free software; you can redistribute it and/or modify it under the 
  6  # terms of the GNU Lesser General Public License as published by the Free 
  7  # Software Foundation; either version 2.1 of the License, or (at your option) 
  8  # any later version. 
  9  # 
 10  # 'ssh' is distrubuted in the hope that it will be useful, but WITHOUT ANY 
 11  # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR 
 12  # A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more 
 13  # details. 
 14  # 
 15  # You should have received a copy of the GNU Lesser General Public License 
 16  # along with 'ssh'; if not, write to the Free Software Foundation, Inc., 
 17  # 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA. 
 18   
 19  """ 
 20  SSH Agent interface for Unix clients. 
 21  """ 
 22   
 23  import os 
 24  import socket 
 25  import struct 
 26  import sys 
 27  import threading 
 28  import time 
 29  import tempfile 
 30  import stat 
 31  import fcntl 
 32  from select import select 
 33   
 34  from ssh.ssh_exception import SSHException 
 35  from ssh.message import Message 
 36  from ssh.pkey import PKey 
 37  from ssh.channel import Channel 
 38  from ssh.common import io_sleep 
 39   
 40  SSH2_AGENTC_REQUEST_IDENTITIES, SSH2_AGENT_IDENTITIES_ANSWER, \ 
 41      SSH2_AGENTC_SIGN_REQUEST, SSH2_AGENT_SIGN_RESPONSE = range(11, 15) 
 42   
43 -class AgentSSH(object):
44 """ 45 Client interface for using private keys from an SSH agent running on the 46 local machine. If an SSH agent is running, this class can be used to 47 connect to it and retreive L{PKey} objects which can be used when 48 attempting to authenticate to remote SSH servers. 49 50 Because the SSH agent protocol uses environment variables and unix-domain 51 sockets, this probably doesn't work on Windows. It does work on most 52 posix platforms though (Linux and MacOS X, for example). 53 """
54 - def __init__(self):
55 self._conn = None 56 self._keys = ()
57
58 - def get_keys(self):
59 """ 60 Return the list of keys available through the SSH agent, if any. If 61 no SSH agent was running (or it couldn't be contacted), an empty list 62 will be returned. 63 64 @return: a list of keys available on the SSH agent 65 @rtype: tuple of L{AgentKey} 66 """ 67 return self._keys
68
69 - def _connect(self, conn):
70 self._conn = conn 71 ptype, result = self._send_message(chr(SSH2_AGENTC_REQUEST_IDENTITIES)) 72 if ptype != SSH2_AGENT_IDENTITIES_ANSWER: 73 raise SSHException('could not get keys from ssh-agent') 74 keys = [] 75 for i in range(result.get_int()): 76 keys.append(AgentKey(self, result.get_string())) 77 result.get_string() 78 self._keys = tuple(keys)
79
80 - def _close(self):
81 #self._conn.close() 82 self._conn = None 83 self._keys = ()
84
85 - def _send_message(self, msg):
86 msg = str(msg) 87 self._conn.send(struct.pack('>I', len(msg)) + msg) 88 l = self._read_all(4) 89 msg = Message(self._read_all(struct.unpack('>I', l)[0])) 90 return ord(msg.get_byte()), msg
91
92 - def _read_all(self, wanted):
93 result = self._conn.recv(wanted) 94 while len(result) < wanted: 95 if len(result) == 0: 96 raise SSHException('lost ssh-agent') 97 extra = self._conn.recv(wanted - len(result)) 98 if len(extra) == 0: 99 raise SSHException('lost ssh-agent') 100 result += extra 101 return result
102
103 -class AgentProxyThread(threading.Thread):
104 """ Class in charge of communication between two chan """
105 - def __init__(self, agent):
106 threading.Thread.__init__(self, target=self.run) 107 self._agent = agent 108 self._exit = False
109
110 - def run(self):
111 try: 112 (r,addr) = self.get_connection() 113 self.__inr = r 114 self.__addr = addr 115 self._agent.connect() 116 self._communicate() 117 except: 118 #XXX Not sure what to do here ... raise or pass ? 119 raise
120
121 - def _communicate(self):
122 oldflags = fcntl.fcntl(self.__inr, fcntl.F_GETFL) 123 fcntl.fcntl(self.__inr, fcntl.F_SETFL, oldflags | os.O_NONBLOCK) 124 while not self._exit: 125 events = select([self._agent._conn, self.__inr], [], [], 0.5) 126 for fd in events[0]: 127 if self._agent._conn == fd: 128 data = self._agent._conn.recv(512) 129 if len(data) != 0: 130 self.__inr.send(data) 131 else: 132 break 133 elif self.__inr == fd: 134 data = self.__inr.recv(512) 135 if len(data) != 0: 136 self._agent._conn.send(data) 137 else: 138 break 139 time.sleep(io_sleep)
140
141 -class AgentLocalProxy(AgentProxyThread):
142 """ 143 Class to be used when wanting to ask a local SSH Agent being 144 asked from a remote fake agent (so use a unix socket for ex.) 145 """
146 - def __init__(self, agent):
148
149 - def get_connection(self):
150 """ Return a pair of socket object and string address 151 May Block ! 152 """ 153 conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) 154 try: 155 conn.bind(self._agent._get_filename()) 156 conn.listen(1) 157 (r,addr) = conn.accept() 158 return (r, addr) 159 except: 160 raise 161 return None
162
163 -class AgentRemoteProxy(AgentProxyThread):
164 """ 165 Class to be used when wanting to ask a remote SSH Agent 166 """
167 - def __init__(self, agent, chan):
168 AgentProxyThread.__init__(self, agent) 169 self.__chan = chan
170
171 - def get_connection(self):
172 """ 173 Class to be used when wanting to ask a local SSH Agent being 174 asked from a remote fake agent (so use a unix socket for ex.) 175 """ 176 return (self.__chan, None)
177
178 -class AgentClientProxy(object):
179 """ 180 Class proxying request as a client: 181 -> client ask for a request_forward_agent() 182 -> server creates a proxy and a fake SSH Agent 183 -> server ask for establishing a connection when needed, 184 calling the forward_agent_handler at client side. 185 -> the forward_agent_handler launch a thread for connecting 186 the remote fake agent and the local agent 187 -> Communication occurs ... 188 """
189 - def __init__(self, chanClient):
190 self._conn = None 191 self.__chanC = chanClient 192 chanClient.request_forward_agent(self._forward_agent_handler)
193
194 - def __del__(self):
195 self.close()
196
197 - def connect(self):
198 """ 199 Method automatically called by the run() method of the AgentProxyThread 200 """ 201 if ('SSH_AUTH_SOCK' in os.environ) and (sys.platform != 'win32'): 202 conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) 203 try: 204 conn.connect(os.environ['SSH_AUTH_SOCK']) 205 except: 206 # probably a dangling env var: the ssh agent is gone 207 return 208 elif sys.platform == 'win32': 209 import win_pageant 210 if win_pageant.can_talk_to_agent(): 211 conn = win_pageant.PageantConnection() 212 else: 213 return 214 else: 215 # no agent support 216 return 217 self._conn = conn
218
219 - def close(self):
220 """ 221 Close the current connection and terminate the agent 222 Should be called manually 223 """ 224 if hasattr(self, "thread"): 225 self.thread._exit = True 226 self.thread.join(1000) 227 if self._conn is not None: 228 self._conn.close()
229
230 - def _forward_agent_handler(self, chanRemote):
231 self.thread = AgentRemoteProxy(self, chanRemote) 232 self.thread.start()
233
234 -class AgentServerProxy(AgentSSH):
235 """ 236 @param t : transport used for the Forward for SSH Agent communication 237 238 @raise SSHException: mostly if we lost the agent 239 """
240 - def __init__(self, t):
241 AgentSSH.__init__(self) 242 self.__t = t 243 self._dir = tempfile.mkdtemp('sshproxy') 244 os.chmod(self._dir, stat.S_IRWXU) 245 self._file = self._dir + '/sshproxy.ssh' 246 self.thread = AgentLocalProxy(self) 247 self.thread.start()
248
249 - def __del__(self):
250 self.close()
251
252 - def connect(self):
253 conn_sock = self.__t.open_forward_agent_channel() 254 if conn_sock is None: 255 raise SSHException('lost ssh-agent') 256 conn_sock.set_name('auth-agent') 257 self._connect(conn_sock)
258
259 - def close(self):
260 """ 261 Terminate the agent, clean the files, close connections 262 Should be called manually 263 """ 264 os.remove(self._file) 265 os.rmdir(self._dir) 266 self.thread._exit = True 267 self.thread.join(1000) 268 self._close()
269
270 - def get_env(self):
271 """ 272 Helper for the environnement under unix 273 274 @return: the SSH_AUTH_SOCK Environnement variables 275 @rtype: dict 276 """ 277 env = {} 278 env['SSH_AUTH_SOCK'] = self._get_filename() 279 return env
280
281 - def _get_filename(self):
282 return self._file
283
284 -class Agent(AgentSSH):
285 """ 286 Client interface for using private keys from an SSH agent running on the 287 local machine. If an SSH agent is running, this class can be used to 288 connect to it and retreive L{PKey} objects which can be used when 289 attempting to authenticate to remote SSH servers. 290 291 Because the SSH agent protocol uses environment variables and unix-domain 292 sockets, this probably doesn't work on Windows. It does work on most 293 posix platforms though (Linux and MacOS X, for example). 294 """ 295
296 - def __init__(self):
297 """ 298 Open a session with the local machine's SSH agent, if one is running. 299 If no agent is running, initialization will succeed, but L{get_keys} 300 will return an empty tuple. 301 302 @raise SSHException: if an SSH agent is found, but speaks an 303 incompatible protocol 304 """ 305 AgentSSH.__init__(self) 306 307 if ('SSH_AUTH_SOCK' in os.environ) and (sys.platform != 'win32'): 308 conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) 309 try: 310 conn.connect(os.environ['SSH_AUTH_SOCK']) 311 except: 312 # probably a dangling env var: the ssh agent is gone 313 return 314 elif sys.platform == 'win32': 315 import win_pageant 316 if win_pageant.can_talk_to_agent(): 317 conn = win_pageant.PageantConnection() 318 else: 319 return 320 else: 321 # no agent support 322 return 323 self._connect(conn)
324
325 - def close(self):
326 """ 327 Close the SSH agent connection. 328 """ 329 self._close()
330
331 -class AgentKey(PKey):
332 """ 333 Private key held in a local SSH agent. This type of key can be used for 334 authenticating to a remote server (signing). Most other key operations 335 work as expected. 336 """ 337
338 - def __init__(self, agent, blob):
339 self.agent = agent 340 self.blob = blob 341 self.name = Message(blob).get_string()
342
343 - def __str__(self):
344 return self.blob
345
346 - def get_name(self):
347 return self.name
348
349 - def sign_ssh_data(self, rng, data):
350 msg = Message() 351 msg.add_byte(chr(SSH2_AGENTC_SIGN_REQUEST)) 352 msg.add_string(self.blob) 353 msg.add_string(data) 354 msg.add_int(0) 355 ptype, result = self.agent._send_message(msg) 356 if ptype != SSH2_AGENT_SIGN_RESPONSE: 357 raise SSHException('key cannot be used for signing') 358 return result.get_string()
359