class CryptoBoxContainer finished
This commit is contained in:
parent
c6ef2a3eb4
commit
7443b4684e
5 changed files with 735 additions and 75 deletions
|
|
@ -1,13 +1,568 @@
|
|||
'''
|
||||
TODO
|
||||
'''
|
||||
from CryptoBoxLogger import CryptoBoxLogger
|
||||
import subprocess
|
||||
import os
|
||||
import re
|
||||
|
||||
"""exceptions:
|
||||
VolumeIsActive
|
||||
InvalidName
|
||||
NameActivelyUsed
|
||||
InvalidPassword
|
||||
InvalidType
|
||||
MountError
|
||||
ChangePasswordError
|
||||
"""
|
||||
|
||||
class CryptoBoxContainer:
|
||||
'''
|
||||
TODO
|
||||
'''
|
||||
|
||||
def __init__(self, device):
|
||||
Progs = {
|
||||
"cryptsetup":"/sbin/cryptsetup",
|
||||
"mkfs-data":"/sbin/mkfs.ext3",
|
||||
"mkfs-config":"/sbin/mkfs.ext2",
|
||||
"blkid":"/sbin/blkid",
|
||||
"mount":"/bin/mount",
|
||||
"umount":"/bin/umount"}
|
||||
|
||||
|
||||
Types = {
|
||||
"unused":0,
|
||||
"plain":1,
|
||||
"luks":2,
|
||||
"swap":3}
|
||||
|
||||
|
||||
__fsTypes = {
|
||||
"plain":["ext3", "ext2", "vfat", "reiser"],
|
||||
"swap":["swap"]}
|
||||
"TODO: mehr Dateisystemtypen? / 'reiser' pruefen"
|
||||
|
||||
__dmDir = "/dev/mapper"
|
||||
|
||||
|
||||
def __init__(self, device, cbox, logger):
|
||||
self.device = device
|
||||
self.logger = logger
|
||||
self.cbox = cbox
|
||||
self.__resetObject()
|
||||
|
||||
|
||||
def getName(self):
|
||||
return self.name
|
||||
|
||||
|
||||
def setName(self, new_name):
|
||||
"TODO: den Test-Code pruefen"
|
||||
if new_name == self.name: return
|
||||
if self.isMounted():
|
||||
raise "VolumeIsActive", "the container must be inactive during renaming"
|
||||
if not re.search(r'^[a-zA-Z0-9_\.\- ]$', new_name):
|
||||
raise "InvalidName", "the supplied new name contains illegal characters"
|
||||
"check for active partitions with the same name"
|
||||
prev_name_owner = self.cbox.getContainerList(filterName=new_name)
|
||||
if prev_name_owner:
|
||||
for a in prev_name_owner:
|
||||
if a.isMounted():
|
||||
raise "NameActivelyUsed", "the supplied new name is already in use for an active partition"
|
||||
self.cbox.setNameForUUID(self.uuid, new_name)
|
||||
self.name = new_name
|
||||
|
||||
|
||||
def getDevice(self):
|
||||
return self.device
|
||||
|
||||
|
||||
def getType(self):
|
||||
return self.type
|
||||
|
||||
|
||||
def isMounted(self):
|
||||
return os.path.ismount(self.__getMountPoint())
|
||||
|
||||
|
||||
def create(self, type, password=None):
|
||||
if type == self.Types["luks"]:
|
||||
self.__createLuks(password)
|
||||
self.__resetObject()
|
||||
return
|
||||
if type == self.Types["plain"]:
|
||||
self.__createPlain()
|
||||
self.__resetObject()
|
||||
return
|
||||
raise "InvalidType", "invalid container type (%d) supplied" % (type, )
|
||||
|
||||
|
||||
def changePassword(self, oldpw, newpw):
|
||||
if self.type != self.Types["luks"]:
|
||||
raise "InvalidType", \
|
||||
"changing of password is possible only for luks containers"
|
||||
if not oldpw:
|
||||
raise "InvalidPassword", "no old password supplied for password change"
|
||||
if not newpw:
|
||||
raise "InvalidPassword", "no new password supplied for password change"
|
||||
"return if new and old passwords are the same"
|
||||
if oldpw == newpw: return
|
||||
if self.isMounted():
|
||||
raise "VolumeIsActive", "this container is currently active"
|
||||
devnull = None
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
"remove any potential open luks mapping"
|
||||
self.__umountLuks()
|
||||
"create the luks header"
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = subprocess.PIPE,
|
||||
stdout = subprocess.PIPE,
|
||||
stderr = subprocess.PIPE,
|
||||
args = [
|
||||
self.Progs["cryptsetup"],
|
||||
"--batch-mode",
|
||||
"luksAddKey",
|
||||
self.device])
|
||||
proc.stdin.write("%s\n%s" % (oldpw, newpw))
|
||||
(output, errout) = proc.communicate()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not add a new luks key: %s - %s" % (output.strip(), errout.strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["error"],
|
||||
errorMsg)
|
||||
raise "ChangePasswordError", errorMsg
|
||||
keys_found = re.search(r'key slot (\d{1,3}) unlocked', output).groups()
|
||||
if keys_found:
|
||||
keyslot = int(keys_found[0])
|
||||
else:
|
||||
raise "ChangePasswordError", "could not get the old key slot"
|
||||
"remove the old key"
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = None,
|
||||
stdout = devnull,
|
||||
stderr = subprocess.PIPE,
|
||||
args = [
|
||||
self.Progs["cryptsetup"],
|
||||
"--batch-mode",
|
||||
"luksDelKey",
|
||||
self.device,
|
||||
"%d" % (keyslot, )])
|
||||
proc.wait()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not remove the old luks key: %s" % (proc.stderr.read().strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["error"],
|
||||
errorMsg)
|
||||
raise "ChangePasswordError", errorMsg
|
||||
|
||||
|
||||
|
||||
" ****************** internal stuff ********************* "
|
||||
|
||||
def __resetObject(self):
|
||||
""" recheck the information about this container
|
||||
this is especially useful after changing the type via 'create' """
|
||||
self.uuid = self.__getUUID()
|
||||
self.type = self.__getTypeOfPartition()
|
||||
self.name = self.__getNameOfContainer()
|
||||
if self.type == self.Types["luks"]:
|
||||
self.mount = self.__mountLuks
|
||||
self.umount = self.__umountLuks
|
||||
if self.type == self.Types["plain"]:
|
||||
self.mount = self.__mountPlain
|
||||
self.umount = self.__umountPlain
|
||||
|
||||
|
||||
def __getNameOfContainer(self):
|
||||
"retrieve the name of the container by querying the database"
|
||||
def_name = self.cbox.getNameForUUID(self.uuid)
|
||||
if def_name: return def_name
|
||||
"there is no name defined for this uuid - we will propose a good one"
|
||||
prefix = self.cbox.getConfigValue("DefaultNamePrefix")
|
||||
unused_found = False
|
||||
counter = 1
|
||||
while not unused_found:
|
||||
guess = prefix + str(counter)
|
||||
if self.cbox.getUUIDForName(guess):
|
||||
counter += 1
|
||||
else:
|
||||
unused_found = True
|
||||
self.cbox.setNameForUUID(self.uuid, guess)
|
||||
return guess
|
||||
|
||||
|
||||
def __getUUID(self):
|
||||
"""return UUID for luks partitions, ext2/3 and vfat filesystems"""
|
||||
devnull = None
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
proc = subprocess.Popen(
|
||||
shell=False,
|
||||
stdin=None,
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=devnull,
|
||||
args=[self.Progs["blkid"],
|
||||
"-s", "UUID",
|
||||
"-o", "value",
|
||||
"-c", os.devnull,
|
||||
"-w", os.devnull,
|
||||
self.device])
|
||||
proc.wait()
|
||||
if proc.returncode != 0:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"retrieving of partition type via 'blkid' failed: %s" % (proc.stderr.read().strip(), ))
|
||||
return None
|
||||
result = proc.stdout.read().strip()
|
||||
devnull.close()
|
||||
if result: return result
|
||||
return self.device.replace(os.path.sep, "_")
|
||||
|
||||
|
||||
def __getTypeOfPartition(self):
|
||||
"retrieve the type of the given partition (see CryptoBoxContainer.Types)"
|
||||
if self.__isLuksPartition(): return self.Types["luks"]
|
||||
typeOfPartition = self.__getTypeIdOfPartition()
|
||||
if typeOfPartition in self.__fsTypes["plain"]:
|
||||
return self.Types["plain"]
|
||||
if typeOfPartition in self.__fsTypes["swap"]:
|
||||
return self.Types["swap"]
|
||||
return self.Types["unused"]
|
||||
|
||||
|
||||
def __getTypeIdOfPartition(self):
|
||||
"returns the type of the partition (see 'man blkid')"
|
||||
devnull = None
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
proc = subprocess.Popen(
|
||||
shell=False,
|
||||
stdin=None,
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=subprocess.PIPE,
|
||||
args=[self.Progs["blkid"],
|
||||
"-s", "TYPE",
|
||||
"-o", "value",
|
||||
"-c", os.devnull,
|
||||
"-w", os.devnull,
|
||||
self.device])
|
||||
proc.wait()
|
||||
if proc.returncode != 0:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"retrieving of partition type via 'blkid' failed: %s" % (proc.stderr.read().strip(), ))
|
||||
return None
|
||||
output = proc.stdout.read().strip()
|
||||
devnull.close()
|
||||
return output
|
||||
|
||||
|
||||
def __isLuksPartition(self):
|
||||
"check if the given device is a luks partition"
|
||||
devnull = None
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = None,
|
||||
stdout = devnull,
|
||||
stderr = devnull,
|
||||
args = [
|
||||
self.Progs["cryptsetup"],
|
||||
"--batch-mode",
|
||||
"isLuks",
|
||||
self.device])
|
||||
proc.wait()
|
||||
devnull.close()
|
||||
return proc.returncode == 0
|
||||
|
||||
|
||||
def __getMountPoint(self):
|
||||
"return the name of the mountpoint of this volume"
|
||||
return os.path.join(self.cbox.getConfigValue("MountParent"), self.name)
|
||||
|
||||
|
||||
def __mountLuks(self, password):
|
||||
"mount a luks partition"
|
||||
if not password:
|
||||
raise "InvalidPassword", "no password supplied for luksOpen"
|
||||
if self.isMounted(): raise "VolumeIsActive", "this container is already active"
|
||||
self.__umountLuks()
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = subprocess.PIPE,
|
||||
stdout = devnull,
|
||||
stderr = subprocess.PIPE,
|
||||
args = [
|
||||
self.Progs["cryptsetup"],
|
||||
"luksOpen",
|
||||
"--batch-mode",
|
||||
self.device,
|
||||
self.name])
|
||||
proc.stdin.write(password)
|
||||
(output, errout) = proc.communicate()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not open the luks mapping: %s" % (errout.strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
errorMsg)
|
||||
raise "MountError", errorMsg
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = None,
|
||||
stdout = devnull,
|
||||
stderr = devnull,
|
||||
args = [
|
||||
self.Progs["mount"],
|
||||
os.path.join(self.__dmDir, self.name),
|
||||
self.__getMountPoint()])
|
||||
proc.wait()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not mount the filesystem: %s" % (proc.stderr.read().strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
errorMsg)
|
||||
raise "MountError", errorMsg
|
||||
devnull.close()
|
||||
|
||||
|
||||
def __umountLuks(self):
|
||||
"umount a luks partition"
|
||||
devnull = None
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
if self.isMounted():
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = None,
|
||||
stdout = devnull,
|
||||
stderr = devnull,
|
||||
args = [self.Progs["umount"], "-l", self.__getMountPoint()])
|
||||
proc.wait()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not umount the filesystem: %s" % (proc.stderr.read().strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
errorMsg)
|
||||
raise "MountError", errorMsg
|
||||
if os.path.exists(os.path.join(self.__dmDir, self.name)):
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = None,
|
||||
stdout = devnull,
|
||||
stderr = subprocess.PIPE,
|
||||
args = [
|
||||
self.Progs["cryptsetup"],
|
||||
"--batch-mode",
|
||||
"luksClose",
|
||||
self.name])
|
||||
proc.wait()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not remove the luks mapping: %s" % (proc.stderr.read().strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
errorMsg)
|
||||
raise "MountError", errorMsg
|
||||
devnull.close()
|
||||
|
||||
|
||||
def __mountPlain(self):
|
||||
"mount a plaintext partition"
|
||||
devnull = None
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
self.__cleanMountDirs()
|
||||
if not os.path.exists(self.__getMountPoint()):
|
||||
os.mkdir(self.__getMountPoint())
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = None,
|
||||
stdout = devnull,
|
||||
stderr = subprocess.PIPE,
|
||||
args = [
|
||||
self.Progs["mount"],
|
||||
self.device,
|
||||
self.__getMountPoint()])
|
||||
proc.wait()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not mount the filesystem: %s" % (proc.stderr.read().strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
errorMsg)
|
||||
raise "MountError", errorMsg
|
||||
devnull.close()
|
||||
|
||||
|
||||
def __umountPlain(self):
|
||||
"umount a plaintext partition"
|
||||
devnull = None
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = None,
|
||||
stdout = devnull,
|
||||
stderr = subprocess.PIPE,
|
||||
args = [
|
||||
self.Progs["umount"],
|
||||
"-l",
|
||||
self.__getMountPoint()])
|
||||
proc.wait()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not umount the filesystem: %s" % (proc.stderr.read().strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
errorMsg)
|
||||
raise "MountError", errorMsg
|
||||
devnull.close()
|
||||
|
||||
|
||||
def __createPlain(self):
|
||||
"make a plaintext partition"
|
||||
if self.isMounted():
|
||||
raise "VolumeIsActive", \
|
||||
"deactivate the partition before filesystem initialization"
|
||||
devnull = None
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = None,
|
||||
stdout = devnull,
|
||||
stderr = subprocess.PIPE,
|
||||
args = [
|
||||
self.Progs["mkfs-data"],
|
||||
self.device])
|
||||
proc.wait()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not create the filesystem: %s" % (proc.stderr.read().strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["error"],
|
||||
errorMsg)
|
||||
raise "CreateError", errorMsg
|
||||
devnull.close()
|
||||
|
||||
|
||||
def __createLuks(self, password):
|
||||
"make a luks partition"
|
||||
if not password:
|
||||
raise "InvalidPassword", "no password supplied for new luks mapping"
|
||||
if self.isMounted():
|
||||
raise "VolumeIsActive", \
|
||||
"deactivate the partition before filesystem initialization"
|
||||
devnull = None
|
||||
try:
|
||||
devnull = open(os.devnull, "w")
|
||||
except IOError:
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["warn"],
|
||||
"Could not open %s" % (os.devnull, ))
|
||||
"remove any potential open luks mapping"
|
||||
self.__umountLuks()
|
||||
"create the luks header"
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = subprocess.PIPE,
|
||||
stdout = devnull,
|
||||
stderr = subprocess.PIPE,
|
||||
args = [
|
||||
self.Progs["cryptsetup"],
|
||||
"--batch-mode",
|
||||
"--cipher", self.cbox.getConfigValue("DefaultCipher"),
|
||||
"--iter-time", "2000",
|
||||
"luksFormat",
|
||||
self.device])
|
||||
proc.stdin.write(password)
|
||||
(output, errout) = proc.communicate()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not create the luks header: %s" % (errout.strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["error"],
|
||||
errorMsg)
|
||||
raise "CreateError", errorMsg
|
||||
"open the luks container for mkfs"
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = subprocess.PIPE,
|
||||
stdout = devnull,
|
||||
stderr = subprocess.PIPE,
|
||||
args = [
|
||||
self.Progs["cryptsetup"],
|
||||
"--batch-mode",
|
||||
"luksOpen",
|
||||
self.device,
|
||||
self.name])
|
||||
proc.stdin.write(password)
|
||||
(output, errout) = proc.communicate()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not open the new luks mapping: %s" % (errout.strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["error"],
|
||||
errorMsg)
|
||||
raise "CreateError", errorMsg
|
||||
"make the filesystem"
|
||||
proc = subprocess.Popen(
|
||||
shell = False,
|
||||
stdin = None,
|
||||
stdout = devnull,
|
||||
stderr = devnull,
|
||||
args = [
|
||||
self.Progs["mkfs-data"],
|
||||
os.path.join(self.__dmDir, self.name)])
|
||||
proc.wait()
|
||||
"remove the mapping - for every exit status"
|
||||
self.__umountLuks()
|
||||
if proc.returncode != 0:
|
||||
errorMsg = "Could not create the filesystem: %s" % (proc.stderr.read().strip(), )
|
||||
self.logger.printMessage(
|
||||
CryptoBoxLogger.DebugLevels["error"],
|
||||
errorMsg)
|
||||
"remove the luks mapping"
|
||||
raise "CreateError", errorMsg
|
||||
devnull.close()
|
||||
|
||||
|
||||
def __cleanMountDirs(self):
|
||||
""" remove all unnecessary subdirs of the mount parent directory
|
||||
this should be called for every (u)mount """
|
||||
subdirs = os.listdir(self.cbox.getConfigValue("MountParent"))
|
||||
for dir in subdirs:
|
||||
abs_dir = os.path.join(self.cbox.getConfigValue("MountParent"), dir)
|
||||
if (not os.path.islink(abs_dir)) and os.path.isdir(abs_dir) and (not os.path.ismount(abs_dir)): os.rmdir(abs_dir)
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue