| Current File : //usr/lib64/python3.6/site-packages/borg/crypto/__pycache__/key.cpython-36.pyc |
3
up�d�� � @ s� d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZmZm Z d dl
m Z m Z m
Z
d dlmZmZ d dlmZ e� ZddlT ddlmZ dd lmZ dd
lmZmZ dd lmZ dd lm Z m Z dd
lm Z ddlm Z ddlm Z ddlm!Z! ddlm"Z" ddl#m$Z$m%Z% ddl&m'Z' ddl(m)Z) ddl*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1 dfZ2de"kZ3G dd� de�Z4G d d � d e�Z5G d d � d e�Z6G d d!� d!e�Z7G d"d#� d#e�Z8G d$d%� d%e�Z9G d&d'� d'e�Z:G d(d)� d)e�Z;G d*d+� d+e�Z<G d,d-� d-e�Z=G d.d/� d/e�Z>G d0d1� d1e>�Z?G d2d3� d3e�Z@G d4d5� d5e�ZAG d6d7� d7e�ZBG d8d9� d9�ZCd:d;� ZDd<d=� ZEd>d?� ZFd@dA� ZGdBdC� ZHdDdE� ZIG dFdG� dG�ZJG dHdI� dIeJ�ZKdJdK� ZLG dLdM� dM�ZMG dNdO� dO�ZNG dPdQ� dQeJ�ZOG dRdS� dSeP�ZQG dTdU� dUeNeO�ZRG dVdW� dWeO�ZSG dXdY� dYeNeS�ZTG dZd[� d[eNeS�ZUG d\d]� d]eMeT�ZVG d^d_� d_eMeU�ZWG d`da� daeU�ZXG dbdc� dceX�ZYG ddde� deeMeX�ZZeKeReTeUeYeVeWeZfZ[dS )g� N)�
a2b_base64�
b2a_base64�hexlify)�sha256�sha512� pbkdf2_hmac)�HMAC�compare_digest)�
create_logger� )�*)�
Compressor)�
StableDict)�Error�IntegrityError)�yes)� get_keys_dir�get_security_dir)�get_limited_unpacker)�
bin_to_hex)�prepare_subprocess_env)�msgpack)� workarounds)�Key� EncryptedKey)�SaveFile� )� NonceManager)�AES�
bytes_to_long� bytes_to_int�num_aes_blocks� hmac_sha256� blake2b_256�hkdf_hmac_sha512� � Zauthenticated_no_keyc @ s e Zd ZdZdS )�NoPassphraseFailurez can not acquire a passphrase: {}N)�__name__�
__module__� __qualname__�__doc__� r, r, �/usr/lib64/python3.6/key.pyr' & s r' c @ s e Zd ZdZdS )�PassphraseWrongzcpassphrase supplied in BORG_PASSPHRASE, by BORG_PASSCOMMAND or via BORG_PASSPHRASE_FD is incorrect.N)r( r) r* r+ r, r, r, r- r. * s r. c @ s e Zd ZdZdS )�PasscommandFailurez3passcommand supplied in BORG_PASSCOMMAND failed: {}N)r( r) r* r+ r, r, r, r- r/ . s r/ c @ s e Zd ZdZdS )�PasswordRetriesExceededz%exceeded the maximum password retriesN)r( r) r* r+ r, r, r, r- r0 2 s r0 c @ s e Zd ZdZdS )�UnsupportedPayloadErrorzSUnsupported payload type {}. A newer version is required to access this repository.N)r( r) r* r+ r, r, r, r- r1 6 s r1 c @ s e Zd ZdZdS )�UnsupportedManifestErrorzUUnsupported manifest envelope. A newer version is required to access this repository.N)r( r) r* r+ r, r, r, r- r2 : s r2 c @ s e Zd ZdZdS )�KeyfileNotFoundErrorz*No key file for repository {} found in {}.N)r( r) r* r+ r, r, r, r- r3 > s r3 c @ s e Zd ZdZdS )�KeyfileInvalidErrorz/Invalid key file for repository {} found in {}.N)r( r) r* r+ r, r, r, r- r4 B s r4 c @ s e Zd ZdZdS )�KeyfileMismatchErrorz/Mismatch between repository {} and key file {}.N)r( r) r* r+ r, r, r, r- r5 F s r5 c @ s e Zd ZdZdS )�RepoKeyNotFoundErrorz2No key entry found in the config of repository {}.N)r( r) r* r+ r, r, r, r- r6 J s r6 c @ s e Zd Zejd�j� ZdZdS )�TAMRequiredErroraT
Manifest is unauthenticated, but it is required for this repository.
This either means that you are under attack, or that you modified this repository
with a Borg version older than 1.0.9 after TAM authentication was enabled.
In the latter case, use "borg upgrade --tam --force '{}'" to re-authenticate the manifest.
FN)r( r) r* �textwrap�dedent�stripr+ � tracebackr, r, r, r- r7 N s
r7 c @ s e Zd Zejd�j� ZdZdS )�ArchiveTAMRequiredErrorzR
Archive '{}' is unauthenticated, but it is required for this repository.
FN)r( r) r* r8 r9 r: r+ r; r, r, r, r- r< Z s
r< c s& e Zd ZejZdZ� fdd�Z� ZS )�
TAMInvalidFc s t � jd� d S )Nz&Manifest authentication did not verify)�super�__init__)�self)� __class__r, r- r? e s zTAMInvalid.__init__)r( r) r* r r+ r; r? �
__classcell__r, r, )rA r- r= a s r= c s& e Zd ZejZdZ� fdd�Z� ZS )�ArchiveTAMInvalidFc s t � jd� d S )Nz%Archive authentication did not verify)r> r? )r@ )rA r, r- r? n s zArchiveTAMInvalid.__init__)r( r) r* r r+ r; r? rB r, r, )rA r- rC j s rC c @ s e Zd ZdZdZdS )�TAMUnsupportedSuiteErrorzMCould not verify manifest: Unsupported suite {!r}; a newer version is needed.FN)r( r) r* r+ r; r, r, r, r- rD s s rD c @ s e Zd ZdZdZdZdS )�KeyBlobStorageZ
no_storage�keyfile�
repositoryN)r( r) r* �
NO_STORAGE�KEYFILE�REPOr, r, r, r- rE x s rE c C sF x@t D ]*}|j|jkr|jd k s$t�|j| |�S qW td|j ��d S )Nz Invalid encryption mode "%s")�AVAILABLE_KEY_TYPES�ARG_NAMEZ
encryption�AssertionError�create�
ValueError)rG �args�keyr, r, r- � key_creator~ s
rR c C s dd� t D �S )Nc S s g | ]}|j r|j �qS r, )rL )�.0rQ r, r, r- �
<listcomp>� s z&key_argument_names.<locals>.<listcomp>)rK r, r, r, r- �key_argument_names� s rU c C s> | d }|t jkrtS x"tD ]}|j|kr |S q W t|��d S )Nr )�
PassphraseKey�TYPE�RepoKeyrK r1 )�
manifest_dataZkey_typerQ r, r, r- � identify_key� s
rZ c C s t |�j| |�S )N)rZ �detect)rG rY r, r, r- � key_factory� s r\ c C s t t| j��}tjj|d�S )N� tam_required)r r �id�os�path�join)rG Z security_dirr, r, r- �tam_required_file� s rb c C s t | �}tjj|�S )N)rb r_ r` �isfile)rG �filer, r, r- r] � s r] c @ sv e Zd ZdZdZdZejZdZ dZ
dd� Z dd� Z dd � Z
dd d �Zd
d� Zdd� Zddd�Zddd�Zddd�ZdS ) �KeyBaseNZ UNDEFINEDFc C s8 t | jg�| _|| _d | _td�| _| jj| _d| _d S )NZlz4T) �bytesrW �TYPE_STRrG �targetr
�
compressor�
decompressr] )r@ rG r, r, r- r? � s
zKeyBase.__init__c C s dS )z1Return HMAC hash using the "id" HMAC key
Nr, )r@ �datar, r, r- �id_hash� s zKeyBase.id_hashc C s d S )Nr, )r@ �chunkr, r, r- �encrypt� s zKeyBase.encryptTc C s d S )Nr, )r@ r^ rk rj r, r, r- �decrypt� s zKeyBase.decryptc C s, |r(| j |�}t||�s(tdt|� ��d S )Nz Chunk %s: id verification failed)rl r r r )r@ r^ rk Z id_computedr, r, r- � assert_id� s
zKeyBase.assert_idc C s" t | j| j | j |d| dd�S )Ns borg-metadata-authentication-�@ )Zikm�salt�infoZ
output_length)r$ �id_key�enc_key� enc_hmac_key)r@ rr �contextr, r, r- �_tam_key� s
zKeyBase._tam_key� manifestc C sr |d krt jd�}t|�}tdtd�|d�� }|d< tj|dd�}| j||�}t||t�j � |d< tj|dd�S )Nrq �HKDF_HMAC_SHA512)�type�hmacrr �tam�surrogateescape)Zunicode_errorsr| )
r_ �urandomr rf r �packbrx r r �digest)r@ Z
metadata_dictrw rr r} Zpacked�tam_keyr, r, r- � pack_and_authenticate_metadata� s
z&KeyBase.pack_and_authenticate_metadatac
C s~ |j d�rt� �| j}|r,|r,tjd� d}t|�}td�}|j|� |j� }t rZ|dfS d|kr�|rxt
| j j j
� ��ntjd� |dfS |jdd �}t|t�s�t� �|jd
d �jd d
�}|dkr�|r�tt|���ntjd|� |dfS |jd�}|jd�} t| t� �st|t� �r t� �|j|�}
td�||
|
d �< | j| dd�} t| |t�j � } t | |��slt� �tjd� |dfS )z8Unpack msgpacked *data* and return (object, did_verify).� �� z!Manifest authentication DISABLED.FZmanifestTs tamz'Manifest TAM not found and not requiredNs types <none>�ascii�replacerz zPIgnoring manifest TAM made with unsupported suite, since TAM is not required: %rs hmacs saltrq s manifest)rw zTAM-verified manifests ����) �
startswithr2 r] �logger�warning� bytearrayr �feed�unpack�AUTHENTICATED_NO_KEYr7 rG � _location�canonical_path�debug�pop�
isinstance�dictr= �get�decoderD �reprrf �indexrx r r r� r )
r@ rk �force_tam_not_requiredr] �unpacker�unpackedr} �tam_type�tam_hmac�tam_salt�offsetr� �calculated_hmacr, r, r- �unpack_and_verify_manifest� sL
z"KeyBase.unpack_and_verify_manifestc C s� | j }|r |r tjd� d}t|�}td�}|j|� |j� }d|kr||rh|jdd�jdd�}t |��ntjd � |dd
fS |j
dd
�}t |t �s�t
� �|jd d �jdd�}|d
kr�|r�tt|���ntjd|� |dd
fS |jd�} |jd�}
t |
t� �s t | t� �rt
� �|j| �} td�|| | d �< | j|
dd�} t| |t�j� }
t|
| ��s~dtk�rxtjd� |dd
fS t
� �tjd� |d|
fS )z>Unpack msgpacked *data* and return (object, did_verify, salt).z Archive authentication DISABLED.F�archives tams names <unknown>r� r� z&Archive TAM not found and not requiredNs types <none>rz zOIgnoring archive TAM made with unsupported suite, since TAM is not required: %rs hmacs saltrq s archive)rw Zignore_invalid_archive_tamz4ignoring invalid archive TAM due to BORG_WORKAROUNDSzTAM-verified archiveT)r] r� r� r� r r� r� r� r� r< r� r� r� rC rD r� rf r� rx r r r� r r )r@ rk r� r] r� r� Z archive_namer} r� r� r� r� r� r� r, r, r- �unpack_and_verify_archive sL
z!KeyBase.unpack_and_verify_archive)T)ry N)F)F)r( r) r* rW �NAMErL rE rH �STORAGE�
chunk_seed�logically_encryptedr? rl rn ro rp rx r� r� r� r, r, r, r- re � s
,re c sp e Zd ZdZdZdZejZdZ dZ
� fdd�Z e dd � �Z
e d
d � �Zd d
� Zdd� Zddd�Zdd� Z� ZS )� PlaintextKeyr Z plaintextZnoner Fc s t � j|� d| _d S )NF)r> r? r] )r@ rG )rA r, r- r? U s zPlaintextKey.__init__c C s t jd� | |�S )NzTEncryption NOT enabled.
Use the "--encryption=repokey|keyfile" to enable encryption.)r� rs )�clsrG rP r, r, r- rN Y s
zPlaintextKey.createc C s | |�S )Nr, )r� rG rY r, r, r- r[ ^ s zPlaintextKey.detectc C s t |�j� S )N)r r� )r@ rk r, r, r- rl b s zPlaintextKey.id_hashc C s | j j|�}dj| j|g�S )N� )ri �compressra rg )r@ rm rk r, r, r- rn e s zPlaintextKey.encryptTc C s` |d | j kr.|d k r t|�nd}td| ��t|�dd � }|sF|S | j|�}| j||� |S )Nr z (unknown)z%Chunk %s: Invalid encryption enveloper )rW r r �
memoryviewrj rp )r@ r^ rk rj �id_str�payloadr, r, r- ro i s
zPlaintextKey.decryptc C s || S )Nr, )r@ rr rw r, r, r- rx t s zPlaintextKey._tam_key)T)r( r) r* rW r� rL rE rH r� r� r� r? � classmethodrN r[ rl rn ro rx rB r, r, )rA r- r� L s
r� c C s t jd�td� S )Nrq )r_ r rf r, r, r, r- �random_blake2b_256_keyx s r� c s* e Zd ZdZdd� Zd� fdd� Z� ZS )�ID_BLAKE2b_256zi
Key mix-in class for using BLAKE2b-256 for the id key.
The id_key length must be 32 bytes.
c C s t | j|�S )N)r# rt )r@ rk r, r, r- rl � s zID_BLAKE2b_256.id_hashNc s* |d ks t �t� j� t� | _t� | _d S )N)rM r> �init_from_random_datar� rv rt )r@ rk )rA r, r- r� � s
z$ID_BLAKE2b_256.init_from_random_data)N)r( r) r* r+ rl r� rB r, r, )rA r- r� � s r� c @ s e Zd ZdZdd� ZdS )�ID_HMAC_SHA_256zj
Key mix-in class for using HMAC-SHA-256 for the id key.
The id_key length must be 32 bytes.
c C s t | j|�S )N)r" rt )r@ rk r, r, r- rl � s zID_HMAC_SHA_256.id_hashN)r( r) r* r+ rl r, r, r, r- r� � s r� c @ sJ e Zd ZdZdZeZdZdd� Zddd �Z d
d � Z
dd
d�Z ddd�Z d S )�
AESKeyBasea�
Common base class shared by KeyfileKey and PassphraseKey
Chunks are encrypted using 256bit AES in Counter Mode (CTR)
Payload layout: TYPE(1) + HMAC(32) + NONCE(8) + CIPHERTEXT
To reduce payload size only 8 bytes of the 16 bytes nonce is saved
in the payload, the first 8 bytes are always zeros. This does not
affect security but limits the maximum repository capacity to
only 295 exabytes!
r � r& Tc C s� | j j|�}| jjtt|��� | jj� dj| jj dd � | jj
|�f�}| j t krdt| j
�dks�| j tkr|t| j
�dks�t�| j | j
|�}dj| j||f�S )Nr� r& � r� )ri r� �
nonce_managerZensure_reservationr! �len�
enc_cipher�resetra �ivrn �MACr# rv r" rM rg )r@ rm rk r| r, r, r- rn � s
" zAESKeyBase.encryptc C s$ |d | j kp$|d tj ko$t| t�sF|d k r6t|�nd}td| ��t|�}|dd� }| jtkrrt | j
�dks�| jt kr�t | j
�dks�t �t| j| j
|dd � ��}t
||�s�|d k r�t|�nd}td| ��| jjt|dd � d
� | jj|d d � �}|�s
|S | j|�}| j||� |S ) Nr z (unknown)z%Chunk %s: Invalid encryption enveloper �! r� r� z/Chunk %s: Encryption envelope checksum mismatch�) )r� )rW rV r� rX r r r� r� r# r� rv r" rM r �
dec_cipherr� �PREFIXro rj rp ) r@ r^ rk rj r� Z data_viewZ
hmac_givenZ
hmac_computedr� r, r, r- ro � s&
zAESKeyBase.decryptc C sB |d | j kp$|d tj ko$t| t�s.td��t|dd� �}|S )Nr z%Manifest: Invalid encryption enveloper� r� )rW rV r� rX r r )r@ r� Znoncer, r, r- �
extract_nonce� s
zAESKeyBase.extract_nonceNc C sl |d krt jd�}|dd� | _|dd� | _|dd� | _t|dd� �| _| jd@ rh| jd d | _d S ) N�d r r� rq �` l l �� r )r_ r ru rv rt r r� )r@ rk r, r, r- r� � s
z AESKeyBase.init_from_random_datar c C sB t d| j|jddd�d�| _t| j| j|�| _t d| jd�| _d S )NT� Zbig)� byteorder)�
is_encryptrQ r� F)r� rQ )r ru �to_bytesr� r rG r� r� )r@ Zmanifest_noncer, r, r- � init_ciphers� s zAESKeyBase.init_ciphersr� r� )T)N)r )
r( r) r* r+ ZPAYLOAD_OVERHEADr" r� r� rn ro r� r� r� r, r, r, r- r� � s
r� c @ s� e Zd Zeddd��Zeddd��Zeddd��Zedd � �Zedd
d ��Zed d
� �Z edd� �Z
eddd��Z dd� Z dd� Z
dS ) �
PassphraseNc C s" t jj||�}|d k r | |�S d S )N)r_ �environr� )r� �env_var�default�
passphraser, r, r- �_env_passphrase� s zPassphrase._env_passphrasec C sD | j d|�}|d k r|S | j� }|d k r,|S | j� }|d k r@|S d S )N�BORG_PASSPHRASE)r� �env_passcommand�
fd_passphrase)r� r� r� r, r, r- �env_passphrase� s zPassphrase.env_passphrasec C s~ t jjdd �}|d k rztdd�}ytjtj|�d|d�}W n0 tjt fk
rj } zt
|��W Y d d }~X nX | |j d��S d S )N�BORG_PASSCOMMANDT)�system)Zuniversal_newlines�env�
) r_ r� r� r �
subprocessZ check_output�shlex�splitZCalledProcessError�FileNotFoundErrorr/ �rstrip)r� r� Z passcommandr� r� �er, r, r- r� s
zPassphrase.env_passcommandc C s^ yt tjjd��}W n ttfk
r, d S X tj|dd��}|j� }W d Q R X | |jd��S )NZBORG_PASSPHRASE_FD�r)�moder� ) �intr_ r� r� rO � TypeError�fdopen�readr� )r� �fd�fr� r, r, r- r� s zPassphrase.fd_passphrasec C s | j d|�S )NZBORG_NEW_PASSPHRASE)r� )r� r� r, r, r- �env_new_passphrase s z Passphrase.env_new_passphrasec C s� yt j |�}W nt tk
r� |r(t� g }x6dD ].}tjj|�d k }|jd||rVdndf � q2W |jd� tdj|��d �Y n
X | |�S d S ) Nr� r� z %s is %s.�setznot setz"Interactive password query failed.� )r� r� ) �getpass�EOFError�printr_ r� r� �appendr' ra )r� �promptZpw�msgr� Z env_var_setr, r, r- r� s
zPassphrase.getpassc C s� d}t ||dddd�r�td| tjd� tdtjd� y|jd � W n> tk
r� td
t|jd �� tjd� td tjd� Y nX d S )
NzDDo you want your passphrase to be displayed for verification? [yN]: zInvalid answer, try again.TZBORG_DISPLAY_PASSPHRASE)Z retry_msgZ invalid_msg�retryZenv_var_overridez-Your passphrase (between double-quotes): "%s")rd zDMake sure the passphrase displayed above is exactly what you wanted.r� z+Your passphrase (UTF-8 encoding in hex): %szutf-8z�As you have a non-ASCII passphrase, it is recommended to keep the UTF-8 encoding in hex together with the passphrase at a safe place.)r r� �sys�stderr�encode�UnicodeEncodeErrorr )r� r� r� r, r, r- � verification* s
zPassphrase.verificationFc C s� | j � }|d k r|S | j� }|d k r(|S xptdd�D ]^}| jd�}|sJ|r�| jd�}||krt| j|� tjd� |S tdtj d� q4tdtj d� q4W t
�d S ) Nr � zEnter new passphrase: z Enter same passphrase again: zDRemember your passphrase. Your data will be inaccessible without it.zPassphrases do not match)rd z Passphrase must not be blank) r� r� �ranger� r� r� rs r� r� r� r0 )r� � allow_emptyr� r� Z passphrase2r, r, r- �new< s"
zPassphrase.newc C s dS )Nz<Passphrase "***hidden***">r, )r@ r, r, r- �__repr__S s zPassphrase.__repr__c C s t d| jd�|||�S )Nr zutf-8)r r� )r@ rr �
iterationsZlengthr, r, r- �kdfV s zPassphrase.kdf)N)N)N)N)F)r( r) r* r� r� r� r� r� r� r� r� r� r� r� r, r, r, r- r� � s
r� c @ sJ e Zd ZdZdZdZejZdZ e
dd� �Z e
dd� �Z d d
� Z
d d � ZdS )
rV r r� Ni�� c C s. | |�}t jd� tjdd�}|j||� |S )Nz9WARNING: "passphrase" mode is unsupported since borg 1.0.F)r� )r� r� r� r� �init)r� rG rP rQ r� r, r, r- rN j s
zPassphraseKey.createc C s� d|j j� }| |�}tj� }|d kr0tj|�}x|tdd�D ]j}|j||� y:|jd |� tt |�d �}|j
|j |�| � ||_ |S t
k
r� tj|�}Y q<X q<W t�d S )NzEnter passphrase for %s: r � r� )r� r� r� r� r� r� r� ro r! r� r� r� � _passphraser r0 )r� rG rY r� rQ r� r� �
num_blocksr, r, r- r[ r s
zPassphraseKey.detectc C s G dd� dt �}|�d S )Nc @ s e Zd ZdZdS )zAPassphraseKey.change_passphrase.<locals>.ImmutablePassphraseErrorz=The passphrase for this encryption key type can't be changed.N)r( r) r* r+ r, r, r, r- �ImmutablePassphraseError� s r� )r )r@ r� r, r, r- �change_passphrase� s z PassphraseKey.change_passphrasec C s* | j |j|j| jd�� | j� d| _d S )Nr� F)r� r� r^ r� r� r] )r@ rG r� r, r, r- r� � s zPassphraseKey.init)r( r) r* rW r� rL rE rH r� r� r� rN r[ r r� r, r, r, r- rV Z s rV c @ sp e Zd Zedd� �Zdd� Zdd� Zdd� Zd d
� Zd d � Z d
d� Z
ddd�Z edd� �Z ddd�Z
dd� ZdS )�KeyfileKeyBasec C s� | |�}|j � }d| }tj� }|d krlt� }|j||�s|x@tdd�D ] }tj|�}|j||�rFP qFW t�n|j||�s|t�tt |�d �}|j
|j |�| � ||_ |S )Nz Enter passphrase for key %s: r r� r� )
�find_keyr� r� �loadr� r� r0 r. r! r� r� r� r� ) r� rG rY rQ rh r� r� r� r� r, r, r- r[ � s$
zKeyfileKeyBase.detectc C s t �d S )N)�NotImplementedError)r@ r, r, r- r � s zKeyfileKeyBase.find_keyc C s t �d S )N)r )r@ rh r� r, r, r- r � s zKeyfileKeyBase.loadc C s� t |�}| j||�}|r~tj|�}t|d�}|jdkr>td��|j| _|j| _|j | _ |j
| _
|j | _ |j dt
| j��| _
dS dS )N)�
internal_dictr z5key version %d is not supported by this borg version.r] TF)r �decrypt_key_filer Zunpackbr �versionr �
repository_idru rv rt r� r� r] rG )r@ �key_datar� �cdatark rQ r, r, r- �_load� s
zKeyfileKeyBase._loadc C s� t d�}|j|� |j� }t|d�}|jdkr<td|j ��|jdkrTtd|j ��|j|j|j d�}t
d|d �j |j �}t
t||�|j�r�|S d S )
NrQ )r r z?encrypted key version %d is not supported by this borg version.r zCencrypted key algorithm '%s' is not supported by this borg version.r� F)r� rQ )r r� r� r r r � algorithmr� rr r� r ro rk r r" �hash)r@ rk r� r� ru rQ r, r, r- r � s
z KeyfileKeyBase.decrypt_key_filec C sZ t jd�}t}|j||d�}t||�}td|d�j|�}td||d||d�}tj |j
� �S )Nr� T)r� rQ r r )r rr r� r r
rk ) r_ r ZPBKDF2_ITERATIONSr� r" r rn r r r� �as_dict) r@ rk r� rr r� rQ r
r
ru r, r, r- �encrypt_key_file� s
z KeyfileKeyBase.encrypt_key_filec C sV t d| j| j| j| j| j| jd�}| jtj |j
� �|�}dj t j
t|�jd���}|S )Nr )r r ru rv rt r� r] r� r� )r r ru rv rt r� r] r r r� r ra r8 Zwrapr r� )r@ r� rQ rk r r, r, r- �_save� s
zKeyfileKeyBase._saveNc C s& |d krt jdd�}| j| j|� d S )NT)r� )r� r� �saverh )r@ r� r, r, r- r � s z KeyfileKeyBase.change_passphrasec C sb t jdd�}| |�}|j|_|j� |j� |j|�}|j||dd� tj d| � tj d� |S )NT)r� )rN zKey in "%s" created.z>Keep this key safe. Your data will be inaccessible without it.)
r� r� r^ r r� r� �get_new_targetr r� rs )r� rG rP r� rQ rh r, r, r- rN � s
zKeyfileKeyBase.createFc C s t �d S )N)r )r@ rh r� rN r, r, r- r � s zKeyfileKeyBase.savec C s t �d S )N)r )r@ rP r, r, r- r s z KeyfileKeyBase.get_new_target)N)F)r( r) r* r� r[ r r r r r r r rN r r r, r, r, r- r � s
r c @ sL e Zd ZdZdZdZejZdZ dd� Z
dd� Z d d
� Z d d � Z
ddd�ZdS )�
KeyfileKeyr zkey filerF �BORG_KEYc
C sx | j j� d }t|�}t|d��N}|jt|��|krFt| jjj � |��|jt|��|krjt
| jjj � |��|S Q R X d S )N� �rb) �FILE_IDr� r �openr� r� r4 rG r� r� r5 )r@ �filenamer^ Zfile_idZrepo_idr� r, r, r- � sanity_check s zKeyfileKey.sanity_checkc
C s� | j j}tjjd�}|r,| jtjj|�|�S t� }xFtj |�D ]8}tjj
||�}y | j||�S t t fk
rt Y q>X q>W t
| j jj� t� ��d S )N�
BORG_KEY_FILE)rG r^ r_ r� r� r r` �abspathr �listdirra r4 r5 r3 r� r� )r@ r^ rF Zkeys_dir�namer r, r, r- r s
zKeyfileKey.find_keyc C sX t jjd�}|r t jj|�S |jj� }|}d}x$t jj|�rR|d7 }|d| }q0W |S )Nr r z.%d)r_ r� r� r` r �locationZto_key_filename�exists)r@ rP rF r r` �ir, r, r- r ( s
zKeyfileKey.get_new_targetc C sF t |d�� }dj|j� dd � �}W d Q R X | j||�}|rB|| _|S )Nr� � r )r ra � readlinesr rh )r@ rh r� r� r �successr, r, r- r 4 s zKeyfileKey.loadFc C sr |r t jj|�r td| ��| j|�}t|��4}|jd| jt| j �f � |j|� |jd� W d Q R X || _
d S )Nz,Aborting because key in "%s" already exists.z%s %s
r� ) r_ r` rc r r r �writer r r rh )r@ rh r� rN r r� r, r, r- r < s
zKeyfileKey.saveN)F)r( r) r* rW r� rL rE rI r� r r r r r r r, r, r, r- r s r c @ s@ e Zd ZdZdZdZejZdd� Z dd� Z
dd� Z d
d
d �Z d S )rX r� Zrepokeyc C s( | j jj� }| j j� }|s$t|�d �|S )N)rG r� r� �load_keyr6 )r@ �locrQ r, r, r- r P s
zRepoKey.find_keyc C s | j S )N)rG )r@ rP r, r, r- r X s zRepoKey.get_new_targetc C sT |dk| _ | j}|j� }|s0|jj� }t|�d �|jd�}| j||�}|rP|| _|S )Nr" zutf-8) r� rG r& r� r� r6 r� r rh )r@ rh r� r r' r$ r, r, r- r [ s
z RepoKey.loadFc C s2 |dk| _ | j|�}|jd�}|j|� || _d S )Nr" zutf-8)r� r r� Zsave_keyrh )r@ rh r� rN r r, r, r- r m s
z RepoKey.saveN)F)
r( r) r* rW r� rL rE rJ r� r r r r r, r, r, r- rX J s rX c @ s& e Zd ZdZdZdZejZdZ e
Z dS )�Blake2KeyfileKeyr� zkey file BLAKE2bzkeyfile-blake2r N) r( r) r* rW r� rL rE rI r� r r# r� r, r, r, r- r( u s r( c @ s" e Zd ZdZdZdZejZe Z
dS )�
Blake2RepoKey� zrepokey BLAKE2bzrepokey-blake2N) r( r) r* rW r� rL rE rJ r� r# r� r, r, r, r- r) s
r) c sZ e Zd ZejZdZ� fdd�Z� fdd�Zd� fdd� Z dd � Z
d
d � Z dd
d�Z � Z
S )�AuthenticatedKeyBaseFc sB t r4td�}|| _|| _|| _|| _d| _d| _dS t� j ||�S )Nr� r FT)
r� rf r ru rv rt r� r] r> r )r@ r r� ZNOPE)rA r, r- r � s zAuthenticatedKeyBase._loadc s t � j||�}d| _|S )NF)r> r r� )r@ rh r� r$ )rA r, r- r � s zAuthenticatedKeyBase.loadc s t � j|||d� d| _d S )N)rN F)r> r r� )r@ rh r� rN )rA r, r- r � s zAuthenticatedKeyBase.savec C s |d | j krtd��dS )Nr z%Manifest: Invalid encryption envelope�* )rW r )r@ r� r, r, r- r� � s z"AuthenticatedKeyBase.extract_noncec C s | j j|�}dj| j|g�S )Nr� )ri r� ra rg )r@ rm rk r, r, r- rn � s z AuthenticatedKeyBase.encryptTc C sX |d | j kr tdt|� ��t|�dd � }|s6|S | j|�}trH|S | j||� |S )Nr zChunk %s: Invalid enveloper )rW r r r� rj r� rp )r@ r^ rk rj r� r, r, r- ro � s
z AuthenticatedKeyBase.decrypt)F)T)r( r) r* rE rJ r� r� r r r r� rn ro rB r, r, )rA r- r+ � s
r+ c @ s e Zd ZdZdZdZdS )�AuthenticatedKey� Z
authenticatedN)r( r) r* rW r� rL r, r, r, r- r- � s r- c @ s e Zd ZdZdZdZdS )�Blake2AuthenticatedKey� zauthenticated BLAKE2bzauthenticated-blake2N)r( r) r* rW r� rL r, r, r, r- r/ � s r/ s )\r� r_ r� r� r8 r� Zbinasciir r r Zhashlibr r r r| r r Z borg.loggerr
r� Z constantsr� r
Zhelpersr r r r r r r r r r r �itemr r �platformr Znoncesr Z low_levelr r r r! r" r# r$ r� r� r' r. r/ r0 r1 r2 r3 r4 r5 r6 r7 r< r= rC rD rE rR rU rZ r\ rb r] re r� r� r� r� r� �strr� rV r r rX r( r) r+ r- r/ rK r, r, r, r- �<module> s� $ &, Km8tD+
8