summaryrefslogtreecommitdiff
path: root/src/leap/bitmask/keymanager/keys.py
blob: 6c0c64ff875fee19a54ff555dea48495334b4c67 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
# -*- coding: utf-8 -*-
# keys.py
# Copyright (C) 2013-2016 LEAP
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
Abstact key type and encryption scheme representations.
"""
import json
import re
import time

from datetime import datetime

from twisted.logger import Logger

from leap.bitmask.keymanager import errors
from leap.bitmask.keymanager.wrapper import TempGPGWrapper
from leap.bitmask.keymanager.validation import ValidationLevels
from leap.bitmask.keymanager import documents as doc

TWO_MONTHS = 60  # 60 days
DEFAULT_THRESHOLD = TWO_MONTHS  # extend or renew key, 2months prior to expiry

log = Logger()


#
# Key handling utilities
#

def is_address(address):
    """
    Return whether the given C{address} is in the form user@provider.

    :param address: The address to be tested.
    :type address: str
    :return: Whether C{address} is in the form user@provider.
    :rtype: bool
    """
    return bool(re.match('[\w.-]+@[\w.-]+', address))


def build_key_from_dict(key, active=None, gpgbinary=None):
    """
    Build an OpenPGPKey key based on info in C{kdict}.

    :param key: Dictionary with key data.
    :type key: dict
    :param active: Dictionary with active data.
    :type active: dict
    :param gpgbinary: Name for GnuPG binary executable.
    :type gpgbinary: C{str}

    :return: An instance of the key.
    :rtype: C{kClass}
    """
    address = None
    validation = ValidationLevels.Weak_Chain
    last_audited_at = None
    encr_used = False
    sign_used = False

    if active:
        address = active[doc.KEY_ADDRESS_KEY]
        try:
            validation = ValidationLevels.get(active[doc.KEY_VALIDATION_KEY])
        except ValueError:
            log.error('Not valid validation level (%s) for key %s',
                      (active[doc.KEY_VALIDATION_KEY],
                       active[doc.KEY_FINGERPRINT_KEY]))
        last_audited_at = _to_datetime(active[doc.KEY_LAST_AUDITED_AT_KEY])
        encr_used = active[doc.KEY_ENCR_USED_KEY]
        sign_used = active[doc.KEY_SIGN_USED_KEY]

    expiry_date = _to_datetime(key[doc.KEY_EXPIRY_DATE_KEY])
    refreshed_at = _to_datetime(key[doc.KEY_REFRESHED_AT_KEY])

    return OpenPGPKey(
        address=address,
        uids=key[doc.KEY_UIDS_KEY],
        fingerprint=key[doc.KEY_FINGERPRINT_KEY],
        key_data=key[doc.KEY_DATA_KEY],
        private=key[doc.KEY_PRIVATE_KEY],
        length=key[doc.KEY_LENGTH_KEY],
        expiry_date=expiry_date,
        last_audited_at=last_audited_at,
        refreshed_at=refreshed_at,
        validation=validation,
        encr_used=encr_used,
        sign_used=sign_used,
        gpgbinary=gpgbinary,
    )


def _to_datetime(unix_time):
    if unix_time != 0:
        return datetime.fromtimestamp(unix_time)
    else:
        return None


def _to_unix_time(date):
    if date is not None:
        return int(time.mktime(date.timetuple()))
    else:
        return 0


class OpenPGPKey(object):

    """
    Base class for OpenPGP keys.
    """

    __slots__ = ('address', 'uids', 'fingerprint', 'key_data',
                 'private', 'length', 'expiry_date', 'validation',
                 'last_audited_at', 'refreshed_at',
                 'encr_used', 'sign_used', '_index', '_gpgbinary')
    log = Logger()

    def __init__(self, address=None, gpgbinary=None, uids=[], fingerprint="",
                 key_data="", private=False, length=0, expiry_date=None,
                 validation=ValidationLevels.Weak_Chain, last_audited_at=None,
                 refreshed_at=None, encr_used=False, sign_used=False):
        self._gpgbinary = gpgbinary
        self.address = address
        if not uids and address:
            self.uids = [address]
        else:
            self.uids = uids
        self.fingerprint = fingerprint
        self.key_data = key_data
        self.private = private
        self.length = length
        self.expiry_date = expiry_date

        self.validation = validation
        self.last_audited_at = last_audited_at
        self.refreshed_at = refreshed_at
        self.encr_used = encr_used
        self.sign_used = sign_used
        self._index = len(self.__slots__)

    @property
    def signatures(self):
        """
        Get the key signatures

        :return: the key IDs that have signed the key
        :rtype: list(str)
        """
        with TempGPGWrapper(keys=[self], gpgbinary=self._gpgbinary) as gpg:
            res = gpg.list_sigs(self.fingerprint)
            for uid, sigs in res.sigs.iteritems():
                if parse_address(uid) in self.uids:
                    return sigs

        return []

    def is_signed_by(self, other_key):
        """
        Checks if current key was signed by another key. Rather than just
        relying on the fingerprint being there, we use gpg's --check-sigs with
        both keys being present in the keychain to check the signature
        validity. By doing so, relying on the long key id instead of the
        fingerprint is fine.

        :param other_key: the other key.
        :return: True if valid signature could be found.
        :rtype: bool
        """
        keys = [self, other_key]
        with TempGPGWrapper(keys=keys, gpgbinary=self._gpgbinary) as gpg:
            certs = gpg.check_sigs(str(self.fingerprint)).certs
            for uid, cur_certs in certs.iteritems():
                if (parse_address(uid) in other_key.uids and
                        other_key.fingerprint[-16:] in cur_certs):
                    return True

            return False

    def merge(self, newkey, key_renewal=False):
        if newkey.fingerprint != self.fingerprint:
            self.log.critical(
                "Can't put a key whith the same key_id and different "
                "fingerprint: %s, %s"
                % (newkey.fingerprint, self.fingerprint))
            raise errors.KeyFingerprintMismatch(newkey.fingerprint)

        with TempGPGWrapper(gpgbinary=self._gpgbinary) as gpg:
            gpg.import_keys(self.key_data)
            gpg.import_keys(newkey.key_data)
            gpgkey = gpg.list_keys(secret=newkey.private).pop()

            if gpgkey['expires']:
                self.expiry_date = datetime.fromtimestamp(
                    int(gpgkey['expires']))
            else:
                self.expiry_date = None

            self.uids = []
            for uid in gpgkey['uids']:
                self.uids.append(parse_address(uid))

            self.length = int(gpgkey['length'])
            self.key_data = gpg.export_keys(gpgkey['fingerprint'],
                                            secret=self.private)

        if newkey.validation > self.validation:
            self.validation = newkey.validation
        if newkey.last_audited_at > self.last_audited_at:
            self.validation = newkey.last_audited_at
        self.encr_used = newkey.encr_used or self.encr_used
        if not key_renewal:
            self.sign_used = newkey.sign_used or self.sign_used
        self.refreshed_at = datetime.now()

    def get_json(self):
        """
        Return a JSON string describing this key.

        :return: The JSON string describing this key.
        :rtype: str
        """
        expiry_date = _to_unix_time(self.expiry_date)
        refreshed_at = _to_unix_time(self.refreshed_at)

        return json.dumps({
            doc.KEY_UIDS_KEY: self.uids,
            doc.KEY_TYPE_KEY: self.__class__.__name__,
            doc.KEY_FINGERPRINT_KEY: self.fingerprint,
            doc.KEY_DATA_KEY: self.key_data,
            doc.KEY_PRIVATE_KEY: self.private,
            doc.KEY_LENGTH_KEY: self.length,
            doc.KEY_EXPIRY_DATE_KEY: expiry_date,
            doc.KEY_REFRESHED_AT_KEY: refreshed_at,
            doc.KEY_VERSION_KEY: doc.KEYMANAGER_DOC_VERSION,
            doc.KEY_TAGS_KEY: [doc.KEYMANAGER_KEY_TAG],
        })

    def get_active_json(self):
        """
        Return a JSON string describing this key.

        :return: The JSON string describing this key.
        :rtype: str
        """
        last_audited_at = _to_unix_time(self.last_audited_at)

        return json.dumps({
            doc.KEY_ADDRESS_KEY: self.address,
            doc.KEY_TYPE_KEY: (self.__class__.__name__ +
                               doc.KEYMANAGER_ACTIVE_TYPE),
            doc.KEY_FINGERPRINT_KEY: self.fingerprint,
            doc.KEY_PRIVATE_KEY: self.private,
            doc.KEY_VALIDATION_KEY: str(self.validation),
            doc.KEY_LAST_AUDITED_AT_KEY: last_audited_at,
            doc.KEY_ENCR_USED_KEY: self.encr_used,
            doc.KEY_SIGN_USED_KEY: self.sign_used,
            doc.KEY_VERSION_KEY: doc.KEYMANAGER_DOC_VERSION,
            doc.KEY_TAGS_KEY: [doc.KEYMANAGER_ACTIVE_TAG],
        })

    def next(self):
        if self._index == 0:
            self._index = len(self.__slots__)
            raise StopIteration

        self._index -= 1
        key = self.__slots__[self._index]

        if key.startswith('_'):
            return self.next()

        value = getattr(self, key)
        if key == "validation":
            value = str(value)
        elif key in ["expiry_date", "last_audited_at", "refreshed_at"]:
            value = str(value)
        return key, value

    def __iter__(self):
        return self

    def __repr__(self):
        """
        Representation of this class
        """
        return u"<%s 0x%s (%s - %s)>" % (
            self.__class__.__name__,
            self.fingerprint,
            self.address,
            "priv" if self.private else "publ")

    def is_active(self):
        """
        Indicates if a key is active.
        :return: True if key is active.
        :rtype: bool
        """
        return True if self.address is not None else False

    def set_unactive(self):
        """
        Sets a key as unactive.
        """
        self.address = None

    def is_expired(self):
        """
        Indicates if a key is expired.
        :return: True if key expired.
        :rtype: bool
        """
        return False if self.expiry_date is None \
            else self.expiry_date < datetime.now()

    def needs_renewal(self, pre_expiration_threshold=DEFAULT_THRESHOLD):
        """
        Indicates if the key is inside the renewal period. For ease of
        transition keys should be renewed/extended before they expire.

        :param pre_expiration_threshold: the amount of days before expiry date
                whereby the key should be renewed -- default value is 60 days
        :type pre_expiration_threshold: int

        :return: True if the current date is within the threshold
        :rtype: Boolean
        """

        days_till_expiry = (self.expiry_date - datetime.now())
        return days_till_expiry.days < pre_expiration_threshold


def parse_address(address):
    """
    Remove name, '<', '>' and the identity suffix after the '+' until the '@'
    e.g.: test_user+something@provider.com becomes test_user@provider.com
    since the key belongs to the identity without the '+' suffix.

    :type address: str
    :rtype: str
    """
    mail_regex = '(.*<)?([\w.-]+)(\+.*)?(@[\w.-]+)(>.*)?'
    match = re.match(mail_regex, address)
    if match is None:
        return None
    return ''.join(match.group(2, 4))