ssh/lvm/lxc backup wip

5 files changed, 277 insertions, 0 deletions

diff --git a/_ssh_client.py b/_ssh_client.py
new file mode 100644
index 0000000..f1c9e23
--- /dev/null
+++ b/_ssh_client.py
@@ -0,0 +1,45 @@
+import paramiko.client as pmc
+
+from ._sshfp_policy import SSHFPPolicy
+
+class SSHConnection:
+    """
+    An SSH client connection to a remote server, with support for a proxy "jump"
+    host, like OpenSSH's 'ssh -J'. Uses only SSHFP for host key verification.
+
+    May be used as a context manager.
+
+    :param SSHRemote remote: Remote host to connect to.
+    """
+    _proxy_conn   = None
+    _client       = None
+
+    def __init__(self, remote):
+        sock = None
+        if remote.proxy_remote is not None:
+            self._proxy_conn = SSHConnection(remote.proxy_remote)
+            t = self._proxy_conn.get_transport()
+            sock = t.open_channel('direct-tcpip', (remote.host, remote.port), ('localhost', 0))
+
+        self._client = pmc.SSHClient()
+        self._client.set_missing_host_key_policy(SSHFPPolicy())
+        self._client.connect(remote.host, remote.port, remote.username,
+                             sock = sock)
+
+    def close(self):
+        if self._client:
+            self._client.close()
+            self._client = None
+        if self._proxy_conn:
+            self._proxy_conn.close()
+            self._proxy_conn = None
+
+    def exec_command(self, *args, **kwargs):
+        return self._client.exec_command(*args, **kwargs)
+    def get_transport(self):
+        return self._client.get_transport()
+
+    def __enter__(self):
+        return self
+    def __exit__(self, exc_type, exc_value, traceback):
+        self.close()
diff --git a/_sshfp_policy.py b/_sshfp_policy.py
new file mode 100644
index 0000000..8b7c2c7
--- /dev/null
+++ b/_sshfp_policy.py
@@ -0,0 +1,61 @@
+import hashlib
+
+from dns import flags, rdatatype, resolver as dnsres
+
+from paramiko.client import MissingHostKeyPolicy
+from paramiko.common import DEBUG
+
+_key_algorithms = {
+    'ssh-rsa' : '1',
+    'ssh-dss' : '2',
+    'ecdsa-sha2-nistp256' : '3',
+    'ecdsa-sha2-nistp384' : '3',
+    'ecdsa-sha2-nistp521' : '3',
+    'ssh-ed25519' : '4',
+}
+
+_hash_funcs = {
+    '1' : hashlib.sha1,
+    '2' : hashlib.sha256,
+}
+
+class SSHFPPolicy(MissingHostKeyPolicy):
+    '''Checks for a matching SSHFP RR'''
+    def __init__(self, resolver = None):
+        if resolver is None:
+            resolver = dnsres.Resolver()
+            resolver.use_edns(0, flags.DO, 1280)
+
+        self._resolver = resolver
+
+    def missing_host_key(self, client, hostname, key):
+        try:
+            key_alg = _key_algorithms[key.get_name()]
+        except KeyError:
+            raise Exception('Unsupported key type for SSHFP: %s' % key.get_name())
+
+        try:
+            resp = self._resolver.query(hostname, 'SSHFP')
+        except dnsres.NoAnswer:
+            raise Exception('Could not obtain SSHFP records for host: %s' % hostname)
+
+        if not resp.response.flags & flags.AD:
+            raise Exception('Answer does not have a valid DNSSEC signature')
+
+        for item in resp:
+            try:
+                alg, fg_type, fg = item.to_text().split()
+            except ValueError:
+                raise Exception('Invalid SSHFP record format: %s' % item.to_text())
+
+            if alg != key_alg:
+                continue
+
+            if not fg_type in _hash_funcs:
+                continue
+
+            fg_expect = _hash_funcs[fg_type](key.asbytes()).hexdigest()
+            if fg_expect == fg:
+                client._log(DEBUG, 'Found valid SSHFP record for host %s' % hostname)
+                return
+        raise Exception('No matching SSHFP records found')
diff --git a/exceptions.py b/exceptions.py
new file mode 100644
index 0000000..8944fe9
--- /dev/null
+++ b/exceptions.py
@@ -0,0 +1,11 @@
+class RemoteExecException(Exception):
+    retcode = None
+    output  = None
+    def __init__(self, explanation, retcode, output):
+        super().__init__(explanation)
+        self.retcode = retcode
+        self.output  = output
+
+    def __str__(self):
+        return (super().__str__() +
+                ';%d: %s' % (self.retcode, self.output.decode('utf-8', errors = 'backslashreplace')))
diff --git a/ssh_remote.py b/ssh_remote.py
new file mode 100644
index 0000000..89e8f17
--- /dev/null
+++ b/ssh_remote.py
@@ -0,0 +1,19 @@
+class SSHRemote:
+    """
+    Specification of an SSH remote host, represented by a combination of host,
+    port and username, plus an optional proxy remote.
+    :param str host:
+    :param int port:
+    :param str username:
+    :param SSHRemote proxy_remote: proxy through which the connection should be
+        tunnelled
+    """
+    host         = None
+    port         = None
+    username     = None
+    proxy_remote = None
+    def __init__(self, host, port, username, proxy_remote = None):
+        self.host         = host
+        self.port         = port
+        self.username     = username
+        self.proxy_remote = proxy_remote
diff --git a/targets.py b/targets.py
index 31964a1..e56b71b 100644
--- a/targets.py
+++ b/targets.py
@@ -3,7 +3,30 @@ from abc import ABC, abstractmethod
 import re
 import subprocess
 
+from .exceptions import RemoteExecException
 from . import repository
+from . import ssh_remote
+from . import _ssh_client
+
+def _parse_name(name):
+    """
+    Parse a backup name into a remote specification.
+    """
+    # split off the username
+    if not '@' in name:
+        raise ValueError('Invalid backup name: "%s", must be of format user@host')
+    username, _, host = name.partition('@')
+
+    port   = 22 # overridden later if specified in name
+    colons = host.count(':')
+    if colons >= 2:   # IPv6 literal, possibly with port
+        m = re.match(r'\[(.+)\](:\d+)?', host, re.ASCII | re.IGNORECASE)
+        if m is not None:   # [literal]:port
+            host, port = m.groups()
+    elif colons == 1: # host:port
+        host, _, port = host.partition(':')
+
+    return ssh_remote.SSHRemote(host, port, username)
 
 class Target(ABC):
     name     = None
@@ -43,3 +66,121 @@ class TargetLocal(Target):
         result = repository.StepResult(retcode, output)
 
         return result
+
+class TargetSSH(Target):
+    _remote = None
+
+    def __init__(self, name, dirs, excludes = None,
+                 remote = None):
+        super().__init__(name, dirs, excludes)
+
+        if remote is None:
+            remote = _parse_name(name)
+        if remote.proxy_remote is not None:
+            raise NotImplementedError('Proxy remote not implemented')
+        if remote.port != 22:
+            raise NotImplementedError('Specifying port not implemented')
+        self._remote = remote
+
+    def save(self, data_dir):
+        cmd = ['bup', 'on', '%s@%s' % (self._remote.username, self._remote.host), 'index', '--update', '--one-file-system']
+        cmd.extend(['--exclude=%s' % e for e in self.excludes])
+        cmd.extend(self.dirs)
+        res_idx = subprocess.run(cmd, capture_output = True)
+
+        cmd = ['bup', 'on', '%s@%s' %(self._remote.username, self._remote.host), 'save', '-n', self.name] + self.dirs
+        res_save = subprocess.run(cmd, capture_output = True)
+
+        retcode = 0
+        output  = b''
+        if res_idx.returncode != 0:
+            retcode = res_idx.returncode
+            output += res_idx.stderr + res_idx.stdout
+        if res_save.returncode != 0:
+            retcode = res_save.returncode
+            output += res_save.stderr + res_save.stdout
+
+        result = repository.StepResult(retcode, output)
+
+        return result
+
+def _paramiko_exec_cmd(client, cmd):
+    res = client.exec_command(cmd)
+    chan = res[0].channel
+    out, err = res[1].read(), res[2].read()
+    if chan.exit_status != 0:
+        raise RemoteExecException('Error executing "%s"' % cmd,
+                                  chan.exit_status, err + out)
+    return out.decode('utf-8', errors = 'backslashreplace')
+
+class TargetSSHLXCLVM(TargetSSH):
+    """
+    This target backs up an LXC container that lives on its own LVM logical
+    volume. Requires root-capable login on the container's host.
+
+    :param SSHRemote parent_remote:
+    """
+    _parent_remote     = None
+    _lxc_username      = None
+    _lxc_containername = None
+
+    def __init__(self, name, dirs, excludes = None,
+                 target_remote = None, parent_remote = None,
+                 lxc_username = None, lxc_containername = None,
+                 snapshot_size = '20G'):
+        super().__init__(name, dirs, excludes, target_remote)
+
+        if parent_remote is None:
+            raise ValueError('parent_remote not specified')
+        if lxc_username is None:
+            lxc_username = parent_remote.usename
+
+        self._parent_remote     = parent_remote
+        self._lxc_username      = lxc_username
+        self._lxc_containername = lxc_containername
+        self._snapshot_size     = snapshot_size
+
+    def save(self, data_dir):
+        with (_ssh_client.SSHConnection(self._parent_remote) as parent,
+              _ssh_client.SSHConnection(self._remote)        as container):
+            # get the PID of the container's init
+            cmd_template = 'su -s /bin/sh -c "{command}" %s' % self._lxc_username
+            container_pid = _paramiko_exec_cmd(parent, cmd_template.format(
+                command = 'lxc-info -H -p -n %s' % self._lxc_containername)).rstrip('\n')
+
+            # get the LV/VG for the container's rootfs
+            container_rootfs = _paramiko_exec_cmd(parent, cmd_template.format(
+                    command = 'lxc-info -H -c lxc.rootfs -n %s' %
+                    self._lxc_containername))\
+                .rstrip('\n')\
+                .translate({ord(' ') : r'\040', ord('\t') : r'\011',
+                           ord('\n') : r'\012', ord('\\') : r'\O134'})
+            mountline = _paramiko_exec_cmd(parent, 'grep "%s" /proc/mounts' %
+                                           container_rootfs).rstrip('\n').split()
+            if len(mountline) < 2 or mountline[1] != container_rootfs:
+                raise RemoteExecException('Invalid mount line: %s' % mountline)
+            lv_path = mountline[0]
+            lv_name, vg_name = _paramiko_exec_cmd(parent,
+                'lvdisplay -C --noheadings -o lv_name,vg_name ' + lv_path)\
+                .strip().split()
+
+            # we cannot trust any binaries located inside the container, since a
+            # compromised container could use them to execute arbitrary code
+            # with real root privileges, thus nullifying the point of
+            # unprivileged containers)
+            # so we now create a temporary
+
+
+            # create a read-only snapshot
+            snapshot_name = 'bupper_' + lv_name
+            _paramiko_exec_cmd(parent,
+                'lvcreate --permission r --snapshot -L {size} -n {name} {origin}'
+                .format(size = self._snapshot_size, name = snapshot_name,
+                        origin = lv_path))
+
+            # execute the backup
+            try:
+                print(container_pid, vg_name, lv_path, snapshot_name)
+            finally:
+                # delete the snapshot
+                _paramiko_exec_cmd(parent, 'lvremove -f %s/%s' % (vg_name, snapshot_name))