| # Copyright 2015 The Chromium OS Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| """The DRM Keys Provisioning Server (DKPS) implementation.""" |
| |
| # TODO(littlecvr): Implement "without filter mode", which lets OEM encrypts DRM |
| # keys directly with ODM's public key, and the key server |
| # merely stores them without knowing anything about them. |
| |
| import argparse |
| import hashlib |
| import imp |
| import json |
| import logging |
| import logging.config |
| import os |
| import shutil |
| import sqlite3 |
| import textwrap |
| import xmlrpc.server |
| |
| import gnupg |
| |
| |
| SCRIPT_DIR = os.path.dirname(os.path.realpath(__file__)) |
| FILTERS_DIR = os.path.join(SCRIPT_DIR, 'filters') |
| PARSERS_DIR = os.path.join(SCRIPT_DIR, 'parsers') |
| CREATE_DATABASE_SQL_FILE_PATH = os.path.join( |
| SCRIPT_DIR, 'sql', 'create_database.sql') |
| |
| DEFAULT_BIND_ADDR = '0.0.0.0' # all addresses |
| DEFAULT_BIND_PORT = 5438 |
| |
| DEFAULT_DATABASE_FILE_NAME = 'dkps.db' |
| DEFAULT_GNUPG_DIR_NAME = 'gnupg' |
| DEFAULT_LOG_FILE_NAME = 'dkps.log' |
| |
| DEFAULT_LOGGING_CONFIG = { |
| 'version': 1, |
| 'formatters': { |
| 'default': { |
| 'format': '%(asctime)s:%(levelname)s:%(funcName)s:' |
| '%(lineno)d:%(message)s'}}, |
| 'handlers': { |
| 'file': { |
| 'class': 'logging.handlers.RotatingFileHandler', |
| 'formatter': 'default', |
| 'filename': DEFAULT_LOG_FILE_NAME, |
| 'maxBytes': 1024 * 1024, # 1M |
| 'backupCount': 3}, |
| 'console': { |
| 'class': 'logging.StreamHandler', |
| 'formatter': 'default', |
| 'stream': 'ext://sys.stdout'}}, |
| 'root': { |
| 'level': 'INFO', |
| # only log to file by default, but also log to console if invoked |
| # directly from the command line |
| 'handlers': ['file'] + ['console'] if __name__ == '__main__' else []}} |
| |
| |
| class ProjectNotFoundException(ValueError): |
| """Raised when no project was found in the database.""" |
| |
| |
| class InvalidUploaderException(ValueError): |
| """Raised when the signature of the uploader can't be verified.""" |
| |
| |
| class InvalidRequesterException(ValueError): |
| """Raised when the signature of the requester can't be verified.""" |
| |
| |
| def GetSQLite3Connection(database_file_path): |
| """Returns a tuple of SQLite3's (connection, cursor) to database_file_path. |
| |
| If the connection has been created before, it is returned directly. If it's |
| not, this function creates the connection, ensures that the foreign key |
| constraint is enabled, and returns. |
| |
| Args: |
| database_file_path: path to the SQLite3 database file. |
| """ |
| database_file_path = os.path.realpath(database_file_path) |
| |
| # Return if the connection to database_file_path has been created before. |
| try: |
| connection = GetSQLite3Connection.connection_dict[database_file_path] |
| return (connection, connection.cursor()) |
| except KeyError: |
| pass |
| except AttributeError: |
| GetSQLite3Connection.connection_dict = {} |
| |
| # Create connection. |
| connection = sqlite3.connect(database_file_path) |
| connection.row_factory = sqlite3.Row |
| cursor = connection.cursor() |
| |
| # Enable foreign key constraint since SQLite3 disables it by default. |
| cursor.execute('PRAGMA foreign_keys = ON') |
| # Check if foreign key constraint is enabled. |
| cursor.execute('PRAGMA foreign_keys') |
| if cursor.fetchone()[0] != 1: |
| raise RuntimeError('Failed to enable SQLite3 foreign key constraint') |
| |
| GetSQLite3Connection.connection_dict[database_file_path] = connection |
| |
| return (connection, cursor) |
| |
| |
| class DRMKeysProvisioningServer: |
| """The DRM Keys Provisioning Server (DKPS) class.""" |
| |
| def __init__(self, database_file_path, gnupg_homedir): |
| """DKPS constructor. |
| |
| Args: |
| database_file_path: path to the SQLite3 database file. |
| gnupg_homedir: path to the GnuPG home directory. |
| """ |
| self.database_file_path = database_file_path |
| self.gnupg_homedir = gnupg_homedir |
| |
| if not os.path.isdir(self.gnupg_homedir): |
| self.gpg = None |
| else: |
| self.gpg = gnupg.GPG(gnupghome=self.gnupg_homedir) |
| |
| if not os.path.isfile(self.database_file_path): |
| self.db_connection, self.db_cursor = (None, None) |
| else: |
| self.db_connection, self.db_cursor = GetSQLite3Connection( |
| self.database_file_path) |
| |
| def Initialize(self, gpg_gen_key_args_dict=None, server_key_file_path=None): |
| """Creates the SQLite3 database and GnuPG home, and imports, or generates a |
| GPG key for the server to use. |
| |
| Args: |
| gpg_gen_key_args_dict: will be passed directly as the keyword arguments to |
| python-gnupg's gen_key() function if server_key_file_path is None. |
| Can be used to customize the key generator process, such as key_type, |
| key_length, etc. See python-gnupg's doc for what can be customized. |
| server_key_file_path: path to the server key to use. If not None, the |
| system will simply import this key and use it as the server key; if |
| None, the system will generate a new key. |
| |
| Raises: |
| RuntimeError is the database and GnuPG home have already been initialized. |
| """ |
| # Create GPG instance and database connection. |
| self.gpg = gnupg.GPG(gnupghome=self.gnupg_homedir) |
| self.db_connection, self.db_cursor = GetSQLite3Connection( |
| self.database_file_path) |
| |
| # If any key exists, the system has already been initialized. |
| if self.gpg.list_keys(): |
| raise RuntimeError('Already initialized') |
| |
| if server_key_file_path: # use existing key |
| # TODO(littlecvr): make sure the server key doesn't have passphrase. |
| server_key_fingerprint, _ = self._ImportGPGKey(server_key_file_path) |
| else: # generate a new GPG key |
| if gpg_gen_key_args_dict is None: |
| gpg_gen_key_args_dict = {} |
| if 'name_real' not in gpg_gen_key_args_dict: |
| gpg_gen_key_args_dict['name_real'] = 'DKPS Server' |
| if 'name_email' not in gpg_gen_key_args_dict: |
| gpg_gen_key_args_dict['name_email'] = 'chromeos-factory-dkps@google.com' |
| if 'name_comment' not in gpg_gen_key_args_dict: |
| gpg_gen_key_args_dict['name_comment'] = 'DRM Keys Provisioning Server' |
| key_input_data = self.gpg.gen_key_input(**gpg_gen_key_args_dict) |
| if 'passphrase' in gpg_gen_key_args_dict: |
| raise RuntimeError('Passphrase for the server key is not supported.') |
| # TODO(treapking): Use no_protection keyword after we upgrade python-gnupg |
| # to 0.4.7, or support passphrase for the server key. |
| key_input_data = key_input_data.replace('%commit\n', |
| '%no-protection\n%commit\n') |
| server_key_fingerprint = self.gpg.gen_key(key_input_data).fingerprint |
| |
| # Create and set up the schema of the database. |
| with open(CREATE_DATABASE_SQL_FILE_PATH) as f: |
| create_database_sql = f.read() |
| with self.db_connection: |
| self.db_cursor.executescript(create_database_sql) |
| |
| # Record the server key fingerprint. |
| with self.db_connection: |
| self.db_cursor.execute( |
| 'INSERT INTO settings (key, value) VALUES (?, ?)', |
| ('server_key_fingerprint', server_key_fingerprint)) |
| |
| def Destroy(self): |
| """Destroys the database and GnuPG home directory. |
| |
| This is the opposite of Initialize(). It essentially removes the SQLite3 |
| database file and GnuPG home directory. |
| """ |
| # Remove database. |
| if self.db_connection: |
| self.db_connection.close() |
| if os.path.exists(self.database_file_path): |
| os.remove(self.database_file_path) |
| |
| # Remove GnuPG home. |
| if self.gpg: |
| self.gpg = None |
| if os.path.exists(self.gnupg_homedir): |
| shutil.rmtree(self.gnupg_homedir) |
| |
| def AddProject(self, name, uploader_key_file_path, requester_key_file_path, |
| parser_module_file_name, filter_module_file_name=None): |
| """Adds a project. |
| |
| Args: |
| name: name of the project, must be unique. |
| uploader_key_file_path: path to the OEM's public key file. |
| requester_key_file_path: path to the ODM's public key file. |
| parser_module_file_name: file name of the parser python module. |
| filter_module_file_name: file name of the filter python module. |
| |
| Raises: |
| ValueError if either the uploader's or requester's key are imported (which |
| means they are used by another project). |
| """ |
| # Try to load the parser and filter modules. |
| self._LoadParserModule(parser_module_file_name) |
| if filter_module_file_name is not None: |
| self._LoadFilterModule(filter_module_file_name) |
| |
| # Try to import uploader and requester keys and add project info into the |
| # database, if failed at any step, delete imported keys. |
| uploader_key_fingerprint, requester_key_fingerprint = (None, None) |
| uploader_key_already_exists, requester_key_already_exists = (False, False) |
| try: |
| uploader_key_fingerprint, uploader_key_already_exists = ( |
| self._ImportGPGKey(uploader_key_file_path)) |
| if uploader_key_already_exists: |
| raise ValueError('Uploader key already exists') |
| requester_key_fingerprint, requester_key_already_exists = ( |
| self._ImportGPGKey(requester_key_file_path)) |
| if requester_key_already_exists: |
| raise ValueError('Requester key already exists') |
| with self.db_connection: |
| self.db_cursor.execute( |
| 'INSERT INTO projects (' |
| ' name, uploader_key_fingerprint, requester_key_fingerprint, ' |
| ' parser_module_file_name, filter_module_file_name) ' |
| 'VALUES (?, ?, ?, ?, ?)', |
| (name, uploader_key_fingerprint, requester_key_fingerprint, |
| parser_module_file_name, filter_module_file_name)) |
| except BaseException: |
| if not uploader_key_already_exists and uploader_key_fingerprint: |
| self.gpg.delete_keys(uploader_key_fingerprint) |
| if not requester_key_already_exists and requester_key_fingerprint: |
| self.gpg.delete_keys(requester_key_fingerprint) |
| raise |
| |
| def UpdateProject(self, name, uploader_key_file_path=None, |
| requester_key_file_path=None, filter_module_file_name=None): |
| """Updates a project. |
| |
| Args: |
| name: name of the project, must be unique. |
| uploader_key_file_path: path to the OEM's public key file. |
| requester_key_file_path: path to the ODM's public key file. |
| filter_module_file_name: file name of the filter python module. |
| |
| Raises: |
| RuntimeError if SQLite3 can't update the project row (for any reason). |
| """ |
| # Try to load the filter module. |
| if filter_module_file_name is not None: |
| self._LoadFilterModule(filter_module_file_name) |
| |
| project = self._FetchProjectByName(name) |
| |
| # Try to import uploader and requester keys and add project info into the |
| # database, if failed at any step, delete any newly imported keys. |
| uploader_key_fingerprint, requester_key_fingerprint = (None, None) |
| old_uploader_key_fingerprint = project['uploader_key_fingerprint'] |
| old_requester_key_fingerprint = project['requester_key_fingerprint'] |
| same_uploader_key, same_requester_key = (True, True) |
| try: |
| sql_set_clause_list = ['filter_module_file_name = ?'] |
| sql_parameters = [filter_module_file_name] |
| |
| if uploader_key_file_path: |
| uploader_key_fingerprint, same_uploader_key = self._ImportGPGKey( |
| uploader_key_file_path) |
| sql_set_clause_list.append('uploader_key_fingerprint = ?') |
| sql_parameters.append(uploader_key_fingerprint) |
| |
| if requester_key_file_path: |
| requester_key_fingerprint, same_requester_key = self._ImportGPGKey( |
| requester_key_file_path) |
| sql_set_clause_list.append('requester_key_fingerprint = ?') |
| sql_parameters.append(requester_key_fingerprint) |
| |
| sql_set_clause = ','.join(sql_set_clause_list) |
| sql_parameters.append(name) |
| with self.db_connection: |
| self.db_cursor.execute( |
| 'UPDATE projects SET %s WHERE name = ?' % sql_set_clause, |
| tuple(sql_parameters)) |
| if self.db_cursor.rowcount != 1: |
| raise RuntimeError('Failed to update project %s' % name) |
| except BaseException: |
| if not same_uploader_key and uploader_key_fingerprint: |
| self.gpg.delete_keys(uploader_key_fingerprint) |
| if not same_requester_key and requester_key_fingerprint: |
| self.gpg.delete_keys(requester_key_fingerprint) |
| raise |
| |
| if not same_uploader_key: |
| self.gpg.delete_keys(old_uploader_key_fingerprint) |
| if not same_requester_key: |
| self.gpg.delete_keys(old_requester_key_fingerprint) |
| |
| def RemoveProject(self, name): |
| """Removes a project. |
| |
| Args: |
| name: the name of the project specified when added. |
| """ |
| project = self._FetchProjectByName(name) |
| |
| self.gpg.delete_keys(project['uploader_key_fingerprint']) |
| self.gpg.delete_keys(project['requester_key_fingerprint']) |
| |
| with self.db_connection: |
| self.db_cursor.execute( |
| 'DELETE FROM drm_keys WHERE project_name = ?', (name,)) |
| self.db_cursor.execute('DELETE FROM projects WHERE name = ?', (name,)) |
| |
| def ListProjects(self): |
| """Lists all projects.""" |
| self.db_cursor.execute('SELECT * FROM projects ORDER BY name ASC') |
| return [dict(row) for row in self.db_cursor.fetchall()] |
| |
| def Upload(self, encrypted_serialized_drm_keys): |
| """Uploads a list of DRM keys to the server. This is an atomic operation. It |
| will either succeed and save all the keys, or fail and save no keys. |
| |
| Args: |
| encrypted_serialized_drm_keys: the serialized DRM keys signed by the |
| uploader and encrypted by the server's public key. |
| |
| Raises: |
| InvalidUploaderException if the signature of the uploader can not be |
| verified. |
| """ |
| decrypted_obj = self.gpg.decrypt(encrypted_serialized_drm_keys.data) |
| project = self._FetchProjectByUploaderKeyFingerprint( |
| decrypted_obj.fingerprint) |
| serialized_drm_keys = decrypted_obj.data |
| |
| # Pass to the parse function. |
| parser_module = self._LoadParserModule(project['parser_module_file_name']) |
| drm_key_list = parser_module.Parse(serialized_drm_keys) |
| |
| drm_key_hash_list = [] |
| for drm_key in drm_key_list: |
| drm_key_hash = hashlib.sha1( |
| json.dumps(drm_key).encode('utf-8')).hexdigest() |
| drm_key_hash_list.append(drm_key_hash) |
| |
| # Pass to the filter function if needed. |
| if project['filter_module_file_name']: # filter module can be null |
| filter_module = self._LoadFilterModule(project['filter_module_file_name']) |
| filtered_drm_key_list = filter_module.Filter(drm_key_list) |
| else: |
| # filter module is optional |
| filtered_drm_key_list = drm_key_list |
| |
| # Fetch server key for signing. |
| server_key_fingerprint = self._FetchServerKeyFingerprint() |
| |
| # Sign and encrypt each key by server's private key and requester's public |
| # key, respectively. |
| encrypted_serialized_drm_key_list = [] |
| requester_key_fingerprint = project['requester_key_fingerprint'] |
| for drm_key in filtered_drm_key_list: |
| encrypted_obj = self.gpg.encrypt( |
| json.dumps(drm_key), requester_key_fingerprint, |
| always_trust=True, sign=server_key_fingerprint) |
| encrypted_serialized_drm_key_list.append(encrypted_obj.data) |
| |
| # Insert into the database. |
| with self.db_connection: |
| self.db_cursor.executemany( |
| 'INSERT INTO drm_keys (' |
| ' project_name, drm_key_hash, encrypted_drm_key) ' |
| 'VALUES (?, ?, ?)', |
| list(zip([project['name']] * len(encrypted_serialized_drm_key_list), |
| drm_key_hash_list, encrypted_serialized_drm_key_list))) |
| |
| def AvailableKeyCount(self, requester_signature): |
| """Queries the number of remaining keys. |
| |
| Args: |
| requester_signature: a message signed by the requester. Since the server |
| doesn't need any additional info from the requester, the requester can |
| simply sign a random string and send it here. |
| |
| Returns: |
| The number of remaining keys that can be requested. |
| |
| Raises: |
| InvalidRequesterException if the signature of the requester can not be |
| verified. |
| """ |
| verified = self.gpg.verify(requester_signature.data) |
| if not verified: |
| raise InvalidRequesterException( |
| 'Invalid requester, check your signing key') |
| |
| project = self._FetchProjectByRequesterKeyFingerprint(verified.fingerprint) |
| |
| self.db_cursor.execute( |
| 'SELECT COUNT(*) AS available_key_count FROM drm_keys ' |
| 'WHERE project_name = ? AND device_serial_number IS NULL', |
| (project['name'],)) |
| return self.db_cursor.fetchone()['available_key_count'] |
| |
| def Request(self, encrypted_device_serial_number): |
| """Requests a DRM key by device serial number. |
| |
| Args: |
| encrypted_device_serial_number: the device serial number signed by the |
| requester and encrypted by the server's public key. |
| |
| Raises: |
| InvalidRequesterException if the signature of the requester can not be |
| verified. RuntimeError if no available keys left in the database. |
| """ |
| decrypted_obj = self.gpg.decrypt(encrypted_device_serial_number.data) |
| project = self._FetchProjectByRequesterKeyFingerprint( |
| decrypted_obj.fingerprint) |
| device_serial_number = decrypted_obj.data |
| |
| def FetchDRMKeyByDeviceSerialNumber(project_name, device_serial_number): |
| self.db_cursor.execute( |
| 'SELECT * FROM drm_keys WHERE project_name = ? AND ' |
| 'device_serial_number = ?', |
| (project_name, device_serial_number)) |
| return self.db_cursor.fetchone() |
| |
| row = FetchDRMKeyByDeviceSerialNumber(project['name'], device_serial_number) |
| if row: # the SN has already paired |
| return row['encrypted_drm_key'] |
| |
| # Find an unpaired key. |
| with self.db_connection: |
| # SQLite3 does not support using LIMIT clause in UPDATE statement by |
| # default, unless SQLITE_ENABLE_UPDATE_DELETE_LIMIT flag is defined during |
| # compilation. Since this script may be deployed on partner's computer, |
| # we'd better assume they don't have this flag on. |
| self.db_cursor.execute( |
| 'UPDATE drm_keys SET device_serial_number = ? ' |
| 'WHERE id = (SELECT id FROM drm_keys WHERE project_name = ? AND ' |
| ' device_serial_number IS NULL LIMIT 1)', |
| (device_serial_number, project['name'])) |
| if self.db_cursor.rowcount != 1: # insufficient keys |
| raise RuntimeError( |
| 'Insufficient DRM keys, ask for the OEM to upload more') |
| |
| row = FetchDRMKeyByDeviceSerialNumber(project['name'], device_serial_number) |
| if row: |
| return row['encrypted_drm_key'] |
| raise RuntimeError('Failed to find paired DRM key') |
| |
| def ListenForever(self, ip, port): |
| """Starts the XML RPC server waiting for commands. |
| |
| Args: |
| ip: IP to bind. |
| port: port to bind. |
| """ |
| class Server(xmlrpc.server.SimpleXMLRPCServer): |
| def _dispatch(self, method, params): |
| # Catch exceptions and log them. Without this, SimpleXMLRPCServer simply |
| # output the error message to stdout, and we won't be able to see what |
| # happened in the log file. |
| logging.info('%s called', method) |
| try: |
| result = xmlrpc.server.SimpleXMLRPCServer._dispatch( |
| self, method, params) |
| return result |
| except BaseException as e: |
| logging.exception(e) |
| raise |
| |
| server = Server((ip, port), allow_none=True) |
| |
| server.register_introspection_functions() |
| server.register_function(self.AvailableKeyCount) |
| server.register_function(self.Upload) |
| server.register_function(self.Request) |
| |
| server.serve_forever() |
| |
| def _ImportGPGKey(self, key_file_path): |
| """Imports a GPG key from a file. |
| |
| Args: |
| key_file_path: path to the GPG key file. |
| |
| Returns: |
| A tuple (key_fingerprint, key_already_exists). The 1st element is the |
| imported key's fingerprint, and the 2nd element is True if the key was |
| already in the database before importing, False otherwise. |
| """ |
| with open(key_file_path) as f: |
| import_results = self.gpg.import_keys(f.read()) |
| key_already_exists = (import_results.imported == 0) |
| key_fingerprint = import_results.fingerprints[0] |
| return (key_fingerprint, key_already_exists) |
| |
| def _LoadFilterModule(self, filter_module_file_name): |
| """Loads the filter module. |
| |
| Args: |
| filter_module_file_name: file name of the filter module in FILTERS_DIR. |
| |
| Returns: |
| The loaded filter module on success. |
| |
| Raises: |
| Exception if failed, see imp.load_source()'s doc for what could be raised. |
| """ |
| return imp.load_source( |
| 'filter_module', os.path.join(FILTERS_DIR, filter_module_file_name)) |
| |
| def _LoadParserModule(self, parser_module_file_name): |
| """Loads the parser module. |
| |
| Args: |
| parser_module_file_name: file name of the parser module in PARSERS_DIR. |
| |
| Returns: |
| The loaded parser module on success. |
| |
| Raises: |
| Exception if failed, see imp.load_source()'s doc for what could be raised. |
| """ |
| return imp.load_source( |
| 'parser_module', os.path.join(PARSERS_DIR, parser_module_file_name)) |
| |
| def _FetchServerKeyFingerprint(self): |
| """Returns the server GPG key's fingerprint.""" |
| self.db_cursor.execute( |
| "SELECT * FROM settings WHERE key = 'server_key_fingerprint'") |
| row = self.db_cursor.fetchone() |
| if not row: |
| raise ValueError('Server key fingerprint not exists') |
| return row['value'] |
| |
| def _FetchOneProject(self, name=None, |
| uploader_key_fingerprint=None, |
| requester_key_fingerprint=None, |
| exception_type=None, error_msg=None): |
| """Fetches the project by name, uploader key fingerprint, or requester key |
| fingerprint. |
| |
| This function combines the name, uploader_key_fingerprint, |
| requester_key_fingerprint conditions (if not None) with the AND operator, |
| and tries to fetch one project from the database. |
| |
| Args: |
| name: name of the project. |
| uploader_key_fingerprint: uploader key fingerprint of the project. |
| requester_key_fingerprint: requester key fingerprint of the project. |
| exception_type: if no project was found and exception_type is not None, |
| raise exception_type with error_msg. |
| error_msg: if no project was found and exception_type is not None, raise |
| exception_type with error_msg. |
| |
| Returns: |
| A project that matches the name, uploader_key_fingerprint, and |
| requester_key_fingerprint conditiions. |
| |
| Raises: |
| exception_type with error_msg if not project was found. |
| """ |
| # pylint: disable=unused-argument |
| where_clause_list = [] |
| params = [] |
| local_vars = locals() |
| for param_name in ['name', 'uploader_key_fingerprint', |
| 'requester_key_fingerprint']: |
| if local_vars[param_name] is not None: |
| where_clause_list.append('%s = ?' % param_name) |
| params.append(locals()[param_name]) |
| if not where_clause_list: |
| raise ValueError('No conditions given to fetch the project') |
| where_clause = 'WHERE ' + ' AND '.join(where_clause_list) |
| |
| self.db_cursor.execute( |
| 'SELECT * FROM projects %s' % where_clause, tuple(params)) |
| project = self.db_cursor.fetchone() |
| |
| if not project and exception_type: |
| raise exception_type(error_msg) |
| |
| return project |
| |
| def _FetchProjectByName(self, name): |
| return self._FetchOneProject( |
| name=name, exception_type=ProjectNotFoundException, |
| error_msg=('Project %s not found' % name)) |
| |
| def _FetchProjectByUploaderKeyFingerprint(self, uploader_key_fingerprint): |
| return self._FetchOneProject( |
| uploader_key_fingerprint=uploader_key_fingerprint, |
| exception_type=InvalidUploaderException, |
| error_msg='Invalid uploader, check your signing key') |
| |
| def _FetchProjectByRequesterKeyFingerprint(self, requester_key_fingerprint): |
| return self._FetchOneProject( |
| requester_key_fingerprint=requester_key_fingerprint, |
| exception_type=InvalidRequesterException, |
| error_msg='Invalid requester, check your signing key') |
| |
| |
| def _ParseArguments(): |
| parser = argparse.ArgumentParser() |
| parser.add_argument( |
| '-d', '--database_file_path', |
| default=os.path.join(SCRIPT_DIR, DEFAULT_DATABASE_FILE_NAME), |
| help='path to the SQLite3 database file, default to "dkps.db" in the ' |
| 'same directory of this script') |
| parser.add_argument( |
| '-g', '--gnupg_homedir', |
| default=os.path.join(SCRIPT_DIR, DEFAULT_GNUPG_DIR_NAME), |
| help='path to the GnuGP home directory, default to "gnupg" in the same ' |
| 'directory of this script') |
| parser.add_argument( |
| '-l', '--log_file_path', |
| default=os.path.join(SCRIPT_DIR, DEFAULT_LOG_FILE_NAME), |
| help='path to the log file, default to "dkps.log" in the same directory ' |
| 'of this script') |
| subparsers = parser.add_subparsers(dest='command') |
| |
| parser_add = subparsers.add_parser('add', help='adds a new project') |
| parser_add.add_argument('-n', '--name', required=True, |
| help='name of the new project') |
| parser_add.add_argument('-u', '--uploader_key_file_path', required=True, |
| help="path to the uploader's public key file") |
| parser_add.add_argument('-r', '--requester_key_file_path', required=True, |
| help="path to the requester's public key file") |
| parser_add.add_argument('-p', '--parser_module_file_name', required=True, |
| help='file name of the parser module') |
| parser_add.add_argument('-f', '--filter_module_file_name', default=None, |
| help='file name of the filter module') |
| |
| subparsers.add_parser('destroy', help='destroys the database') |
| |
| parser_update = subparsers.add_parser('update', |
| help='updates an existing project') |
| parser_update.add_argument('-n', '--name', required=True, |
| help='name of the project') |
| parser_update.add_argument('-u', '--uploader_key_file_path', default=None, |
| help="path to the uploader's public key file") |
| parser_update.add_argument('-r', '--requester_key_file_path', default=None, |
| help="path to the requester's public key file") |
| parser_update.add_argument('-f', '--filter_module_file_name', default=None, |
| help='file name of the filter module') |
| |
| parser_init = subparsers.add_parser('init', help='initializes the database') |
| parser_init.add_argument( |
| '-g', '--gpg_gen_key_args', action='append', nargs=2, default=[], |
| help='arguments to use when generating GPG key for server') |
| parser_init.add_argument( |
| '-s', '--server_key_file_path', default=None, |
| help="path to the server's private key file") |
| |
| subparsers.add_parser('list', help='lists all projects') |
| |
| parser_listen = subparsers.add_parser( |
| 'listen', help='starts the server, waiting for upload or request keys') |
| parser_listen.add_argument( |
| '--ip', default=DEFAULT_BIND_ADDR, |
| help='IP to bind, default to %s' % DEFAULT_BIND_ADDR) |
| parser_listen.add_argument( |
| '--port', type=int, default=DEFAULT_BIND_PORT, |
| help='port to listen, default to %s' % DEFAULT_BIND_PORT) |
| |
| parser_rm = subparsers.add_parser('rm', help='removes an existing project') |
| parser_rm.add_argument('-n', '--name', required=True, |
| help='name of the project to remove') |
| |
| return parser.parse_args() |
| |
| |
| def main(): |
| args = _ParseArguments() |
| |
| logging_config = DEFAULT_LOGGING_CONFIG |
| logging_config['handlers']['file']['filename'] = args.log_file_path |
| logging.config.dictConfig(logging_config) |
| |
| dkps = DRMKeysProvisioningServer(args.database_file_path, args.gnupg_homedir) |
| if args.command == 'init': |
| # Convert from command line arguments to a dict. |
| gpg_gen_key_args_dict = {} |
| for pair in args.gpg_gen_key_args: |
| gpg_gen_key_args_dict[pair[0]] = pair[1] |
| dkps.Initialize(gpg_gen_key_args_dict, args.server_key_file_path) |
| elif args.command == 'destroy': |
| message = ( |
| 'This action will remove all projects and keys information and is NOT ' |
| 'recoverable! Are you sure? (y/N)') |
| answer = input(textwrap.fill(message, 80) + ' ') |
| if answer.lower() != 'y' and answer.lower() != 'yes': |
| print('OK, nothing will be removed.') |
| else: |
| print('Removing all projects and keys information...', end=' ') |
| dkps.Destroy() |
| print('done.') |
| elif args.command == 'listen': |
| dkps.ListenForever(args.ip, args.port) |
| elif args.command == 'list': |
| print(dkps.ListProjects()) |
| elif args.command == 'add': |
| dkps.AddProject( |
| args.name, args.uploader_key_file_path, args.requester_key_file_path, |
| args.parser_module_file_name, args.filter_module_file_name) |
| elif args.command == 'update': |
| dkps.UpdateProject( |
| args.name, args.uploader_key_file_path, args.requester_key_file_path, |
| args.filter_module_file_name) |
| elif args.command == 'rm': |
| dkps.RemoveProject(args.name) |
| else: |
| raise ValueError('Unknown command %s' % args.command) |
| |
| |
| if __name__ == '__main__': |
| main() |